Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by PTZOptics
CVE-2026-75969 (GCVE-0-2026-75969)
Vulnerability from nvd – Published: 2026-09-30 16:27 – Updated: 2026-09-30 20:01
VLAI
EPSS
VEX
Title
PTZOptics Missing Authentication in Firmware Upload
Summary
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
* Move 4K 12X before: 0.0.98
* Move 4K 20X before: 0.1.33
* Move 4K 30X before: 2.1.17
* Link 4K 12X before: 0.0.99
* Link 4K 20X before: 0.1.37
* Link 4K 30X before: 2.1.18
* Move SE 12X before: 9.1.66
* Move SE 20X before: 9.1.44
* Move SE 30X before: 9.1.46
* Studio 4K 12X before: 8.3.32
* Studio 4K 20X before: 8.3.32
* Studio SE 12X before: 8.3.32
* Studio SE 20X before: 8.3.32
* All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
* Upgrade Tool - All versions
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 18:30 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.havsys.com/ |
Impacted products
24 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T18:30:11.739848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:01:02.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.98",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.66",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.46",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-USB-GY-G2, PT12X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-USB-GY-G2, PT20X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTVL-ZCAM, PTVL-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-ZCAM, PT12X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-ZCAM, PT20X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Studio Pro",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "Upgrade Tool",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Haverford Systems Inc. \u0026 PTZOptics would like to thank Jaroslav Svoboda of CESNET for responsibly reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\u003cbr\u003e\n\u003cbr\u003eThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eMove 4K 12X before: 0.0.98\u003c/li\u003e\u003cli\u003eMove 4K 20X before: 0.1.33\u003c/li\u003e\u003cli\u003eMove 4K 30X before: 2.1.17\u003c/li\u003e\u003cli\u003eLink 4K 12X before: 0.0.99\u003c/li\u003e\u003cli\u003eLink 4K 20X before: 0.1.37\u003c/li\u003e\u003cli\u003eLink 4K 30X before: 2.1.18\u003c/li\u003e\u003cli\u003eMove SE 12X before: 9.1.66\u003c/li\u003e\u003cli\u003eMove SE 20X before: 9.1.44\u003c/li\u003e\u003cli\u003eMove SE 30X before: 9.1.46\u003c/li\u003e\u003cli\u003eStudio 4K 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio 4K 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eAll Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\u003c/li\u003e\u003cli\u003eUpgrade Tool - All versions\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\n\n\nThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\n\n\n\n\n\n * Move 4K 12X before: 0.0.98\n * Move 4K 20X before: 0.1.33\n * Move 4K 30X before: 2.1.17\n * Link 4K 12X before: 0.0.99\n * Link 4K 20X before: 0.1.37\n * Link 4K 30X before: 2.1.18\n * Move SE 12X before: 9.1.66\n * Move SE 20X before: 9.1.44\n * Move SE 30X before: 9.1.46\n * Studio 4K 12X before: 8.3.32\n * Studio 4K 20X before: 8.3.32\n * Studio SE 12X before: 8.3.32\n * Studio SE 20X before: 8.3.32\n * All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\n * Upgrade Tool - All versions"
}
],
"impacts": [
{
"capecId": "CAPEC-638",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-638 Altered Component Firmware"
}
]
},
{
"capecId": "CAPEC-669",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-669 Alteration of a Software Update"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:27:51.490Z",
"orgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"shortName": "hsi"
},
"references": [
{
"url": "https://psirt.havsys.com/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eProduct\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eRemediation\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.98.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.33.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.17.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.99.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.37.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.18.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 12X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.66.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 20X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.44.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 30X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.46.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "ProductRemediationMove 4K 12XUpdate to Firmware 0.0.98.Move 4K 20XUpdate to Firmware 0.1.33.Move 4K 30XUpdate to Firmware 2.1.17.Link 4K 12XUpdate to Firmware 0.0.99.Link 4K 20XUpdate to Firmware 0.1.37.Link 4K 30XUpdate to Firmware 2.1.18.Move SE 12X\u00a0Update to Firmware 9.1.66.Move SE 20X\u00a0Update to Firmware 9.1.44.Move SE 30X\u00a0Update to Firmware 9.1.46.Studio 4K 12XUpdate to Firmware 8.3.32Studio 4K 20XUpdate to Firmware 8.3.32.Studio SE 12XUpdate to Firmware 8.3.32.Studio SE 20XUpdate to Firmware 8.3.32"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PTZOptics Missing Authentication in Firmware Upload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eDisable network services until the firmware can be updated.\u003c/li\u003e\u003cli\u003eRestrict access to the camera to a trusted management VLAN.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Disable network services until the firmware can be updated.\n * Restrict access to the camera to a trusted management VLAN."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"assignerShortName": "hsi",
"cveId": "CVE-2026-75969",
"datePublished": "2026-09-30T16:27:51.490Z",
"dateReserved": "2026-08-18T17:26:08.229Z",
"dateUpdated": "2026-09-30T20:01:02.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-35452 (GCVE-0-2025-35452)
Vulnerability from nvd – Published: 2025-09-05 17:49 – Updated: 2025-09-08 18:07
VLAI
EPSS
VEX
Title
Pan-Tilt-Zoom cameras default administrative credentials for web interface
Summary
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2025-09-08 17:57 UTC
References
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT12X-SE-xx-G3 |
Affected:
0 , < 9.1.43
(custom)
Unaffected: 9.1.43 |
|
| PTZOptics | PT12X-LINK-4K-xx |
Affected:
0 , < 0.0.63
(custom)
Unaffected: 0.0.63 |
|
| PTZOptics | PT20X-SE-xx-G3 |
Affected:
0 , < 9.1.32
(custom)
Unaffected: 9.1.32 |
|
| PTZOptics | PT20X-LINK-4K-xx |
Affected:
0 , < 0.0.89
(custom)
Unaffected: 0.0.89 |
|
| PTZOptics | PT30X-SE-xx-G3 |
Affected:
0 , < 9.1.33
(custom)
Unaffected: 9.1.33 |
|
| PTZOptics | PT30X-LINK-4K-xx |
Affected:
0 , < 2.0.71
(custom)
Unaffected: 2.0.71 |
|
| PTZOptics | PT-STUDIOPRO |
Affected:
0 , < 9.0.41
(custom)
Unaffected: 9.0.41 |
|
| PTZOptics | PT12X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT20X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT12X-SDI/NDI-xx |
Affected:
0 , < 6.3.70
(custom)
Unaffected: 6.3.70 |
|
| PTZOptics | PT12X-USB-xx |
Affected:
0 , < 6.2.88
(custom)
Unaffected: 6.2.88 |
|
| PTZOptics | PT20X-SDI/NDI-xx |
Affected:
0 , < 6.3.27
(custom)
Unaffected: 6.3.27 |
|
| SMTAV | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | PT30X-SDI/NDI-xx |
Affected:
0 , < 6.3.43
(custom)
Unaffected: 6.3.43 |
|
| multiCAM Systems | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | VL Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.85
(custom)
Unaffected: 7.2.85 |
|
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 8.1.89
(custom)
Unaffected: 8.1.89 |
|
| PTZOptics | HC-EPTZ-NDI |
Affected:
0 , < 8.2.14
(custom)
Unaffected: 8.2.14 |
|
| PTZOptics | PT12X-4K-xx-G3 |
Affected:
0 , < 0.0.58
(custom)
Unaffected: 0.0.58 |
|
| PTZOptics | PT20X-4K-xx-G3 |
Affected:
0 , < 0.0.85
(custom)
Unaffected: 0.0.85 |
|
| PTZOptics | PT30X-4K-xx-G3 |
Affected:
0 , < 2.0.64
(custom)
Unaffected: 2.0.64 |
|
| PTZOptics | PT20X-USB-xx |
Affected:
0 , < 6.2.81
(custom)
Unaffected: 6.2.81 |
|
| ValueHD | Pan-Tilt-Zoom Cameras |
Affected:
*
|
Date Public
2025-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:05:20.509951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T18:07:29.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "PT12X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.63",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.63"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.32"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.33"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.71",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.71"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT-STUDIOPRO",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.0.41",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.0.41"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.70",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.70"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.88",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.88"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.27",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "SMTAV",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "multiCAM Systems",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "VL Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "12x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "20x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "EPTZ Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC-EPTZ-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.2.14",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.2.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.58",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.58"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.64",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.64"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.81",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.81"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "ValueHD",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"datePublic": "2025-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2025-35452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T17:57:32.559307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T17:58:30.782Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10"
},
{
"name": "url",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35452"
},
{
"name": "url",
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"name": "url",
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
}
],
"title": "Pan-Tilt-Zoom cameras default administrative credentials for web interface"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2025-35452",
"datePublished": "2025-09-05T17:49:02.755Z",
"dateReserved": "2025-04-15T20:57:14.282Z",
"dateUpdated": "2025-09-08T18:07:29.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35451 (GCVE-0-2025-35451)
Vulnerability from nvd – Published: 2025-09-05 17:43 – Updated: 2025-09-08 18:08
VLAI
EPSS
VEX
Title
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
Summary
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2025-09-08 17:57 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
References
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT12X-SE-xx-G3 |
Affected:
0 , < 9.1.43
(custom)
Unaffected: 9.1.43 |
|
| PTZOptics | PT12X-LINK-4K-xx |
Affected:
0 , < 0.0.63
(custom)
Unaffected: 0.0.63 |
|
| PTZOptics | PT20X-SE-xx-G3 |
Affected:
0 , < 9.1.32
(custom)
Unaffected: 9.1.32 |
|
| PTZOptics | PT20X-LINK-4K-xx |
Affected:
0 , < 0.0.89
(custom)
Unaffected: 0.0.89 |
|
| PTZOptics | PT-STUDIOPRO |
Affected:
0 , < 9.0.41
(custom)
Unaffected: 9.0.41 |
|
| PTZOptics | PT30X-SE-xx-G3 |
Affected:
0 , < 9.1.33
(custom)
Unaffected: 9.1.33 |
|
| PTZOptics | PT30X-LINK-4K-xx |
Affected:
0 , < 2.0.71
(custom)
Unaffected: 2.0.71 |
|
| PTZOptics | PT12X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT20X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT12X-SDI/NDI-xx |
Affected:
0 , < 6.3.70
(custom)
Unaffected: 6.3.70 |
|
| PTZOptics | PT12X-USB-xx |
Affected:
0 , < 6.2.88
(custom)
Unaffected: 6.2.88 |
|
| PTZOptics | PT20X-SDI/NDI-xx |
Affected:
0 , < 6.3.27
(custom)
Unaffected: 6.3.27 |
|
| SMTAV | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | PT30X-SDI/NDI-xx |
Affected:
0 , < 6.3.43
(custom)
Unaffected: 6.3.43 |
|
| multiCAM Systems | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | VL Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.85
(custom)
Unaffected: 7.2.85 |
|
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 8.1.89
(custom)
Unaffected: 8.1.89 |
|
| PTZOptics | HC-EPTZ-NDI |
Affected:
0 , < 8.2.14
(custom)
Unaffected: 8.2.14 |
|
| PTZOptics | PT12X-4K-xx-G3 |
Affected:
0 , < 0.0.58
(custom)
Unaffected: 0.0.58 |
|
| PTZOptics | PT20X-4K-xx-G3 |
Affected:
0 , < 0.0.85
(custom)
Unaffected: 0.0.85 |
|
| PTZOptics | PT20X-USB-xx |
Affected:
0 , < 6.2.81
(custom)
Unaffected: 6.2.81 |
|
| PTZOptics | PT30X-4K-xx-G3 |
Affected:
0 , < 2.0.64
(custom)
Unaffected: 2.0.64 |
|
| ValueHD | Pan-Tilt-Zoom Cameras |
Affected:
*
|
Date Public
2025-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:08:16.124259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T18:08:29.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "PT12X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.63",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.63"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.32"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT-STUDIOPRO",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.0.41",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.0.41"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.33"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.71",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.71"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.70",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.70"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.88",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.88"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.27",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "SMTAV",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "multiCAM Systems",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "VL Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "12x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "20x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "EPTZ Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC-EPTZ-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.2.14",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.2.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.58",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.58"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.81",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.81"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.64",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.64"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "ValueHD",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"datePublic": "2025-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2025-35451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T17:57:46.995811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T17:58:14.754Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10"
},
{
"name": "url",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35451"
},
{
"name": "url",
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"name": "url",
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
}
],
"title": "Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2025-35451",
"datePublished": "2025-09-05T17:43:53.108Z",
"dateReserved": "2025-04-15T20:57:14.282Z",
"dateUpdated": "2025-09-08T18:08:29.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8957 (GCVE-0-2024-8957)
Vulnerability from nvd – Published: 2024-09-17 20:08 – Updated: 2025-12-27 16:47 X_Known Exploited VulnerabilityTitle
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
Summary
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Severity
7.2 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-08 18:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | vendor-advisory |
| https://vulncheck.com/advisories/ptzoptics-comman… | third-party-advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31… | exploittechnical-descriptionthird-party-advisory |
| https://www.greynoise.io/blog/greynoise-intellige… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT30X-SDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| PTZOptics | PT30X-NDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| ptzoptics | pt30x-sdi_firmware |
Affected:
0 , < 6.3.40
(semver)
cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:* |
|
| ptzoptics | pt30x-ndi_firmware |
Affected:
0 , < 6.3.40
(semver)
cpe:2.3:o:ptzoptics:pt30x-ndi_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-sdi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-ndi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-ndi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8957",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:25:10.384044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-11-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:44.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit",
"technical-description",
"third-party-advisory"
],
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-04T00:00:00.000Z",
"value": "CVE-2024-8957 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PT30X-SDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT30X-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-sdi:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Konstantin Lazarev of GreyNoise"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.\u003cbr\u003e"
}
],
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-27T16:47:39.385Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://ptzoptics.com/firmware-changelog/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/ptzoptics-command-injection"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-8957",
"datePublished": "2024-09-17T20:08:25.588Z",
"dateReserved": "2024-09-17T19:08:48.129Z",
"dateUpdated": "2025-12-27T16:47:39.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8956 (GCVE-0-2024-8956)
Vulnerability from nvd – Published: 2024-09-17 19:59 – Updated: 2025-11-22 12:09 X_Known Exploited VulnerabilityTitle
PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
Summary
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
Severity
9.1 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-08 15:54 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | vendor-advisory |
| https://vulncheck.com/advisories/ptzoptics-insuff… | third-party-advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31… | technical-descriptionthird-party-advisoryexploit |
| https://www.greynoise.io/blog/greynoise-intellige… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT30X-SDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| PTZOptics | PT30X-NDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| ptzoptics | pt30x-sdi_firmware |
Affected:
0 , < 6.3.40
(custom)
cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:* |
|
| ptzoptics | pt30x-ndi-xx-g2_firmware |
Affected:
0 , < 6.3.40
(custom)
cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-sdi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-ndi-xx-g2_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8956",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-08T15:54:06.883084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-11-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:44.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"technical-description",
"third-party-advisory",
"exploit"
],
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-04T00:00:00.000Z",
"value": "CVE-2024-8956 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PT30X-SDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT30X-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-sdi:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Konstantin Lazarev of GreyNoise"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.\u003cbr\u003e"
}
],
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-22T12:09:58.681Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://ptzoptics.com/firmware-changelog/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/ptzoptics-insufficient-auth"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-8956",
"datePublished": "2024-09-17T19:59:27.205Z",
"dateReserved": "2024-09-17T19:08:47.005Z",
"dateUpdated": "2025-11-22T12:09:58.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75969 (GCVE-0-2026-75969)
Vulnerability from cvelistv5 – Published: 2026-09-30 16:27 – Updated: 2026-09-30 20:01
VLAI
EPSS
VEX
Title
PTZOptics Missing Authentication in Firmware Upload
Summary
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
* Move 4K 12X before: 0.0.98
* Move 4K 20X before: 0.1.33
* Move 4K 30X before: 2.1.17
* Link 4K 12X before: 0.0.99
* Link 4K 20X before: 0.1.37
* Link 4K 30X before: 2.1.18
* Move SE 12X before: 9.1.66
* Move SE 20X before: 9.1.44
* Move SE 30X before: 9.1.46
* Studio 4K 12X before: 8.3.32
* Studio 4K 20X before: 8.3.32
* Studio SE 12X before: 8.3.32
* Studio SE 20X before: 8.3.32
* All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
* Upgrade Tool - All versions
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 18:30 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.havsys.com/ |
Impacted products
24 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T18:30:11.739848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:01:02.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.98",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.1.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Link 4K 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.1.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.66",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.44",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Move SE 30X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.46",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio 4K 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 12X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Firmware Update"
],
"product": "Studio SE 20X",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-USB-GY-G2, PT12X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-USB-GY-G2, PT20X-USB-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTVL-ZCAM, PTVL-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT12X-ZCAM, PT12X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "PT20X-ZCAM, PT20X-NDI-ZCAM",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Studio Pro",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "affected",
"modules": [
"Firmware Update"
],
"product": "Upgrade Tool",
"vendor": "PTZOptics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Haverford Systems Inc. \u0026 PTZOptics would like to thank Jaroslav Svoboda of CESNET for responsibly reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\u003cbr\u003e\n\u003cbr\u003eThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eMove 4K 12X before: 0.0.98\u003c/li\u003e\u003cli\u003eMove 4K 20X before: 0.1.33\u003c/li\u003e\u003cli\u003eMove 4K 30X before: 2.1.17\u003c/li\u003e\u003cli\u003eLink 4K 12X before: 0.0.99\u003c/li\u003e\u003cli\u003eLink 4K 20X before: 0.1.37\u003c/li\u003e\u003cli\u003eLink 4K 30X before: 2.1.18\u003c/li\u003e\u003cli\u003eMove SE 12X before: 9.1.66\u003c/li\u003e\u003cli\u003eMove SE 20X before: 9.1.44\u003c/li\u003e\u003cli\u003eMove SE 30X before: 9.1.46\u003c/li\u003e\u003cli\u003eStudio 4K 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio 4K 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 12X before: 8.3.32\u003c/li\u003e\u003cli\u003eStudio SE 20X before: 8.3.32\u003c/li\u003e\u003cli\u003eAll Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\u003c/li\u003e\u003cli\u003eUpgrade Tool - All versions\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\n\n\nThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\n\n\n\n\n\n * Move 4K 12X before: 0.0.98\n * Move 4K 20X before: 0.1.33\n * Move 4K 30X before: 2.1.17\n * Link 4K 12X before: 0.0.99\n * Link 4K 20X before: 0.1.37\n * Link 4K 30X before: 2.1.18\n * Move SE 12X before: 9.1.66\n * Move SE 20X before: 9.1.44\n * Move SE 30X before: 9.1.46\n * Studio 4K 12X before: 8.3.32\n * Studio 4K 20X before: 8.3.32\n * Studio SE 12X before: 8.3.32\n * Studio SE 20X before: 8.3.32\n * All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\n * Upgrade Tool - All versions"
}
],
"impacts": [
{
"capecId": "CAPEC-638",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-638 Altered Component Firmware"
}
]
},
{
"capecId": "CAPEC-669",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-669 Alteration of a Software Update"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:27:51.490Z",
"orgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"shortName": "hsi"
},
"references": [
{
"url": "https://psirt.havsys.com/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eProduct\u003c/b\u003e\u003c/td\u003e\u003ctd\u003e\u003cb\u003eRemediation\u003c/b\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.98.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.33.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.17.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.0.99.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 0.1.37.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eLink 4K 30X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 2.1.18.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 12X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.66.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 20X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.44.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eMove SE 30X\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 9.1.46.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio 4K 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 12X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eStudio SE 20X\u003c/td\u003e\u003ctd\u003eUpdate to Firmware 8.3.32\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "ProductRemediationMove 4K 12XUpdate to Firmware 0.0.98.Move 4K 20XUpdate to Firmware 0.1.33.Move 4K 30XUpdate to Firmware 2.1.17.Link 4K 12XUpdate to Firmware 0.0.99.Link 4K 20XUpdate to Firmware 0.1.37.Link 4K 30XUpdate to Firmware 2.1.18.Move SE 12X\u00a0Update to Firmware 9.1.66.Move SE 20X\u00a0Update to Firmware 9.1.44.Move SE 30X\u00a0Update to Firmware 9.1.46.Studio 4K 12XUpdate to Firmware 8.3.32Studio 4K 20XUpdate to Firmware 8.3.32.Studio SE 12XUpdate to Firmware 8.3.32.Studio SE 20XUpdate to Firmware 8.3.32"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PTZOptics Missing Authentication in Firmware Upload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eDisable network services until the firmware can be updated.\u003c/li\u003e\u003cli\u003eRestrict access to the camera to a trusted management VLAN.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Disable network services until the firmware can be updated.\n * Restrict access to the camera to a trusted management VLAN."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "16cac6a8-cc1e-4741-89aa-6b97e2437706",
"assignerShortName": "hsi",
"cveId": "CVE-2026-75969",
"datePublished": "2026-09-30T16:27:51.490Z",
"dateReserved": "2026-08-18T17:26:08.229Z",
"dateUpdated": "2026-09-30T20:01:02.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-35452 (GCVE-0-2025-35452)
Vulnerability from cvelistv5 – Published: 2025-09-05 17:49 – Updated: 2025-09-08 18:07
VLAI
EPSS
VEX
Title
Pan-Tilt-Zoom cameras default administrative credentials for web interface
Summary
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2025-09-08 17:57 UTC
References
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT12X-SE-xx-G3 |
Affected:
0 , < 9.1.43
(custom)
Unaffected: 9.1.43 |
|
| PTZOptics | PT12X-LINK-4K-xx |
Affected:
0 , < 0.0.63
(custom)
Unaffected: 0.0.63 |
|
| PTZOptics | PT20X-SE-xx-G3 |
Affected:
0 , < 9.1.32
(custom)
Unaffected: 9.1.32 |
|
| PTZOptics | PT20X-LINK-4K-xx |
Affected:
0 , < 0.0.89
(custom)
Unaffected: 0.0.89 |
|
| PTZOptics | PT30X-SE-xx-G3 |
Affected:
0 , < 9.1.33
(custom)
Unaffected: 9.1.33 |
|
| PTZOptics | PT30X-LINK-4K-xx |
Affected:
0 , < 2.0.71
(custom)
Unaffected: 2.0.71 |
|
| PTZOptics | PT-STUDIOPRO |
Affected:
0 , < 9.0.41
(custom)
Unaffected: 9.0.41 |
|
| PTZOptics | PT12X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT20X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT12X-SDI/NDI-xx |
Affected:
0 , < 6.3.70
(custom)
Unaffected: 6.3.70 |
|
| PTZOptics | PT12X-USB-xx |
Affected:
0 , < 6.2.88
(custom)
Unaffected: 6.2.88 |
|
| PTZOptics | PT20X-SDI/NDI-xx |
Affected:
0 , < 6.3.27
(custom)
Unaffected: 6.3.27 |
|
| SMTAV | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | PT30X-SDI/NDI-xx |
Affected:
0 , < 6.3.43
(custom)
Unaffected: 6.3.43 |
|
| multiCAM Systems | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | VL Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.85
(custom)
Unaffected: 7.2.85 |
|
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 8.1.89
(custom)
Unaffected: 8.1.89 |
|
| PTZOptics | HC-EPTZ-NDI |
Affected:
0 , < 8.2.14
(custom)
Unaffected: 8.2.14 |
|
| PTZOptics | PT12X-4K-xx-G3 |
Affected:
0 , < 0.0.58
(custom)
Unaffected: 0.0.58 |
|
| PTZOptics | PT20X-4K-xx-G3 |
Affected:
0 , < 0.0.85
(custom)
Unaffected: 0.0.85 |
|
| PTZOptics | PT30X-4K-xx-G3 |
Affected:
0 , < 2.0.64
(custom)
Unaffected: 2.0.64 |
|
| PTZOptics | PT20X-USB-xx |
Affected:
0 , < 6.2.81
(custom)
Unaffected: 6.2.81 |
|
| ValueHD | Pan-Tilt-Zoom Cameras |
Affected:
*
|
Date Public
2025-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:05:20.509951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T18:07:29.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "PT12X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.63",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.63"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.32"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.33"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.71",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.71"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT-STUDIOPRO",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.0.41",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.0.41"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.70",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.70"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.88",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.88"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.27",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "SMTAV",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "multiCAM Systems",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "VL Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "12x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "20x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "EPTZ Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC-EPTZ-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.2.14",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.2.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.58",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.58"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.64",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.64"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.81",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.81"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "ValueHD",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"datePublic": "2025-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2025-35452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T17:57:32.559307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T17:58:30.782Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10"
},
{
"name": "url",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35452"
},
{
"name": "url",
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"name": "url",
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
}
],
"title": "Pan-Tilt-Zoom cameras default administrative credentials for web interface"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2025-35452",
"datePublished": "2025-09-05T17:49:02.755Z",
"dateReserved": "2025-04-15T20:57:14.282Z",
"dateUpdated": "2025-09-08T18:07:29.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-35451 (GCVE-0-2025-35451)
Vulnerability from cvelistv5 – Published: 2025-09-05 17:43 – Updated: 2025-09-08 18:08
VLAI
EPSS
VEX
Title
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
Summary
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2025-09-08 17:57 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
References
Impacted products
25 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT12X-SE-xx-G3 |
Affected:
0 , < 9.1.43
(custom)
Unaffected: 9.1.43 |
|
| PTZOptics | PT12X-LINK-4K-xx |
Affected:
0 , < 0.0.63
(custom)
Unaffected: 0.0.63 |
|
| PTZOptics | PT20X-SE-xx-G3 |
Affected:
0 , < 9.1.32
(custom)
Unaffected: 9.1.32 |
|
| PTZOptics | PT20X-LINK-4K-xx |
Affected:
0 , < 0.0.89
(custom)
Unaffected: 0.0.89 |
|
| PTZOptics | PT-STUDIOPRO |
Affected:
0 , < 9.0.41
(custom)
Unaffected: 9.0.41 |
|
| PTZOptics | PT30X-SE-xx-G3 |
Affected:
0 , < 9.1.33
(custom)
Unaffected: 9.1.33 |
|
| PTZOptics | PT30X-LINK-4K-xx |
Affected:
0 , < 2.0.71
(custom)
Unaffected: 2.0.71 |
|
| PTZOptics | PT12X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT20X-STUDIO-4K-xx-G3 |
Affected:
0 , < 8.1.90
(custom)
Unaffected: 8.1.90 |
|
| PTZOptics | PT12X-SDI/NDI-xx |
Affected:
0 , < 6.3.70
(custom)
Unaffected: 6.3.70 |
|
| PTZOptics | PT12X-USB-xx |
Affected:
0 , < 6.2.88
(custom)
Unaffected: 6.2.88 |
|
| PTZOptics | PT20X-SDI/NDI-xx |
Affected:
0 , < 6.3.27
(custom)
Unaffected: 6.3.27 |
|
| SMTAV | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | PT30X-SDI/NDI-xx |
Affected:
0 , < 6.3.43
(custom)
Unaffected: 6.3.43 |
|
| multiCAM Systems | Pan-Tilt-Zoom Cameras |
Affected:
*
|
|
| PTZOptics | VL Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.85
(custom)
Unaffected: 7.2.85 |
|
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 7.2.94
(custom)
Unaffected: 7.2.94 |
|
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera |
Affected:
0 , < 8.1.89
(custom)
Unaffected: 8.1.89 |
|
| PTZOptics | HC-EPTZ-NDI |
Affected:
0 , < 8.2.14
(custom)
Unaffected: 8.2.14 |
|
| PTZOptics | PT12X-4K-xx-G3 |
Affected:
0 , < 0.0.58
(custom)
Unaffected: 0.0.58 |
|
| PTZOptics | PT20X-4K-xx-G3 |
Affected:
0 , < 0.0.85
(custom)
Unaffected: 0.0.85 |
|
| PTZOptics | PT20X-USB-xx |
Affected:
0 , < 6.2.81
(custom)
Unaffected: 6.2.81 |
|
| PTZOptics | PT30X-4K-xx-G3 |
Affected:
0 , < 2.0.64
(custom)
Unaffected: 2.0.64 |
|
| ValueHD | Pan-Tilt-Zoom Cameras |
Affected:
*
|
Date Public
2025-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-35451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:08:16.124259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T18:08:29.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "PT12X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.63",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.63"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.32",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.32"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT-STUDIOPRO",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.0.41",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.0.41"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SE-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "9.1.33",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.1.33"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-LINK-4K-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.71",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.71"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-STUDIO-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.90",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.90"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.70",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.70"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.88",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.88"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.27",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "SMTAV",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-SDI/NDI-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.43",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.3.43"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "multiCAM Systems",
"versions": [
{
"status": "affected",
"version": "*"
}
]
},
{
"defaultStatus": "unknown",
"product": "VL Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "12x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "20x Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "7.2.94",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.2.94"
}
]
},
{
"defaultStatus": "unknown",
"product": "EPTZ Fixed Camera/NDI Fixed Camera",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.1.89",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.1.89"
}
]
},
{
"defaultStatus": "unknown",
"product": "HC-EPTZ-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "8.2.14",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.2.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT12X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.58",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.58"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "0.0.85",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.0.85"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT20X-USB-xx",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.2.81",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.2.81"
}
]
},
{
"defaultStatus": "unknown",
"product": "PT30X-4K-xx-G3",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "2.0.64",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.0.64"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pan-Tilt-Zoom Cameras",
"vendor": "ValueHD",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"datePublic": "2025-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2025-35451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T17:57:46.995811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T17:58:14.754Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10"
},
{
"name": "url",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json"
},
{
"name": "url",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35451"
},
{
"name": "url",
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"name": "url",
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
}
],
"title": "Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2025-35451",
"datePublished": "2025-09-05T17:43:53.108Z",
"dateReserved": "2025-04-15T20:57:14.282Z",
"dateUpdated": "2025-09-08T18:08:29.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8957 (GCVE-0-2024-8957)
Vulnerability from cvelistv5 – Published: 2024-09-17 20:08 – Updated: 2025-12-27 16:47 X_Known Exploited VulnerabilityTitle
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
Summary
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Severity
7.2 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-08 18:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | vendor-advisory |
| https://vulncheck.com/advisories/ptzoptics-comman… | third-party-advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31… | exploittechnical-descriptionthird-party-advisory |
| https://www.greynoise.io/blog/greynoise-intellige… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT30X-SDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| PTZOptics | PT30X-NDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| ptzoptics | pt30x-sdi_firmware |
Affected:
0 , < 6.3.40
(semver)
cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:* |
|
| ptzoptics | pt30x-ndi_firmware |
Affected:
0 , < 6.3.40
(semver)
cpe:2.3:o:ptzoptics:pt30x-ndi_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-sdi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-ndi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-ndi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8957",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T18:25:10.384044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-11-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:44.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit",
"technical-description",
"third-party-advisory"
],
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-04T00:00:00.000Z",
"value": "CVE-2024-8957 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PT30X-SDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT30X-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-sdi:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Konstantin Lazarev of GreyNoise"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.\u003cbr\u003e"
}
],
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-27T16:47:39.385Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://ptzoptics.com/firmware-changelog/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/ptzoptics-command-injection"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-8957",
"datePublished": "2024-09-17T20:08:25.588Z",
"dateReserved": "2024-09-17T19:08:48.129Z",
"dateUpdated": "2025-12-27T16:47:39.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8956 (GCVE-0-2024-8956)
Vulnerability from cvelistv5 – Published: 2024-09-17 19:59 – Updated: 2025-11-22 12:09 X_Known Exploited VulnerabilityTitle
PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
Summary
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
Severity
9.1 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-08 15:54 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | vendor-advisory |
| https://vulncheck.com/advisories/ptzoptics-insuff… | third-party-advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31… | technical-descriptionthird-party-advisoryexploit |
| https://www.greynoise.io/blog/greynoise-intellige… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PTZOptics | PT30X-SDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| PTZOptics | PT30X-NDI |
Affected:
0 , < 6.3.40
(semver)
|
|
| ptzoptics | pt30x-sdi_firmware |
Affected:
0 , < 6.3.40
(custom)
cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:* |
|
| ptzoptics | pt30x-ndi-xx-g2_firmware |
Affected:
0 , < 6.3.40
(custom)
cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-sdi_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "pt30x-ndi-xx-g2_firmware",
"vendor": "ptzoptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8956",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-08T15:54:06.883084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-11-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:44.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"technical-description",
"third-party-advisory",
"exploit"
],
"url": "https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-04T00:00:00.000Z",
"value": "CVE-2024-8956 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PT30X-SDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PT30X-NDI",
"vendor": "PTZOptics",
"versions": [
{
"lessThan": "6.3.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-sdi:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ptzoptics:pt30x-ndi-xx-g2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.40",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Konstantin Lazarev of GreyNoise"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.\u003cbr\u003e"
}
],
"value": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-22T12:09:58.681Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://ptzoptics.com/firmware-changelog/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/ptzoptics-insufficient-auth"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-8956",
"datePublished": "2024-09-17T19:59:27.205Z",
"dateReserved": "2024-09-17T19:08:47.005Z",
"dateUpdated": "2025-11-22T12:09:58.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}