CVE-2025-14746

MEDIUM

Shenzhenningyuandatechnology Tc155 Firmware - Authentication Bypass

Title source: rule

Description

A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such manipulation leads to improper authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.336519

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.336519

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.707195

[Exploit, Third Party Advisory] https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-RTSP.md

View Exploit ZIP pw:eip

Scores

CVSS v3 4.3

EPSS 0.0016

EPSS Percentile 36.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (1)

shenzhenningyuandatechnology/tc155_firmware 57.0.2.0

Published Dec 16, 2025

Tracked Since Feb 18, 2026