| タイトル | Shenzhen Ningyuanda Technology Co., Ltd. TC155 IP Camera Firmware version: 57.0.2.0 Unauthenticated ONVIF PTZ Full Remote Camera Control |
|---|
| 説明 | The TC155 IP Camera exposes its ONVIF PTZ control interface without requiring any form of authentication. The PTZ service endpoint (/onvif/device_service) is active and accepts movement commands from any network peer.
An unauthenticated attacker on the same network segment can issue ContinuousMove actions against the camera’s PTZ motor. This allows repositioning the camera to redirect or suppress its field of view, bypass surveillance coverage, or force persistent disorientation of the device.
The vulnerability exists due to the firmware accepting PTZ SOAP requests without validating the requester’s identity or enforcing profile‑level capability checks. |
|---|
| ソース | ⚠️ https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-PTZ-Remote-Control.md |
|---|
| ユーザー | keroomi (UID 62127) |
|---|
| 送信 | 2025年12月05日 11:52 (7 月 ago) |
|---|
| モデレーション | 2025年12月15日 21:39 (10 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 336522 [Ningyuanda TC155 57.0.2.0 ONVIF PTZ Control Interface /onvif/device_service 特権昇格] |
|---|
| ポイント | 20 |
|---|