Vulnerability Intelligence Report
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
CVE-2025-35451
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-798 ↗CWE-798 Use of Hard-coded Credentials
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PTZOptics | PT12X-SE-xx-G3 | 0 < 9.1.43 (affected), 9.1.43 (unaffected) |
| PTZOptics | PT12X-LINK-4K-xx | 0 < 0.0.63 (affected), 0.0.63 (unaffected) |
| PTZOptics | PT20X-SE-xx-G3 | 0 < 9.1.32 (affected), 9.1.32 (unaffected) |
| PTZOptics | PT20X-LINK-4K-xx | 0 < 0.0.89 (affected), 0.0.89 (unaffected) |
| PTZOptics | PT-STUDIOPRO | 0 < 9.0.41 (affected), 9.0.41 (unaffected) |
| PTZOptics | PT30X-SE-xx-G3 | 0 < 9.1.33 (affected), 9.1.33 (unaffected) |
| PTZOptics | PT30X-LINK-4K-xx | 0 < 2.0.71 (affected), 2.0.71 (unaffected) |
| PTZOptics | PT12X-STUDIO-4K-xx-G3 | 0 < 8.1.90 (affected), 8.1.90 (unaffected) |
| PTZOptics | PT20X-STUDIO-4K-xx-G3 | 0 < 8.1.90 (affected), 8.1.90 (unaffected) |
| PTZOptics | PT12X-SDI/NDI-xx | 0 < 6.3.70 (affected), 6.3.70 (unaffected) |
| PTZOptics | PT12X-USB-xx | 0 < 6.2.88 (affected), 6.2.88 (unaffected) |
| PTZOptics | PT20X-SDI/NDI-xx | 0 < 6.3.27 (affected), 6.3.27 (unaffected) |
| SMTAV | Pan-Tilt-Zoom Cameras | * (affected) |
| PTZOptics | PT30X-SDI/NDI-xx | 0 < 6.3.43 (affected), 6.3.43 (unaffected) |
| multiCAM Systems | Pan-Tilt-Zoom Cameras | * (affected) |
| PTZOptics | VL Fixed Camera/NDI Fixed Camera | 0 < 7.2.94 (affected), 7.2.94 (unaffected) |
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera | 0 < 7.2.85 (affected), 7.2.85 (unaffected) |
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera | 0 < 7.2.94 (affected), 7.2.94 (unaffected) |
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera | 0 < 8.1.89 (affected), 8.1.89 (unaffected) |
| PTZOptics | HC-EPTZ-NDI | 0 < 8.2.14 (affected), 8.2.14 (unaffected) |
| PTZOptics | PT12X-4K-xx-G3 | 0 < 0.0.58 (affected), 0.0.58 (unaffected) |
| PTZOptics | PT20X-4K-xx-G3 | 0 < 0.0.85 (affected), 0.0.85 (unaffected) |
| PTZOptics | PT20X-USB-xx | 0 < 6.2.81 (affected), 6.2.81 (unaffected) |
| PTZOptics | PT30X-4K-xx-G3 | 0 < 2.0.64 (affected), 2.0.64 (unaffected) |
| ValueHD | Pan-Tilt-Zoom Cameras | * (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.722%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · CERT · USA |
| Reserved | 2025-04-15T20:57:14 |
| Published | 2025-09-05T17:43:53 |
| Patch Date | 2025-06-12 |
| Last Updated | 2025-09-08T18:08:29 |
Community Chatter & Buzz