What’s Vulnerable › Vulnerabilities
CVE-2025-35451: Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-09-05 · updated 2026-06-17
- Weakness: CWE-798
Description
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Affected products
- Multicam-Systems Mcamii Ptz Firmware: all versions
- PTZOptics Ndi Fixed Camera Firmware: through 7.2.94
- PTZOptics Pt12X-Ndi-Xx Firmware: through 6.3.34
- PTZOptics Pt12X-Sdi-Xx-G2 Firmware: through 6.3.34
- PTZOptics Pt12X-Usb-Xx-G2 Firmware: through 6.2.81
- PTZOptics Pt12X-Zcam Firmware: through 7.2.76
- PTZOptics Pt20X-Ndi-Xx Firmware: through 6.3.20
- PTZOptics Pt20X-Sdi-Xx-G2 Firmware: through 6.3.20
- PTZOptics Pt20X-Usb-Xx-G2 Firmware: through 6.2.73
- PTZOptics Pt20X-Zcam Firmware: through 7.2.82
- PTZOptics Pt30X-Ndi-Xx Firmware: through 6.3.30
- PTZOptics Pt30X-Sdi-Xx-G2 Firmware: through 6.3.30
- PTZOptics Pteptz-Ndi-Zcam-G2 Firmware: through 8.1.81
- PTZOptics Pteptz-Zcam-G2 Firmware: through 8.1.81
- PTZOptics Ptvl-Zcam Firmware: through 7.2.79
- PTZOptics Vl Fixed Camera Firmware: through 7.2.94
- SMTAV Ba12-N Firmware: all versions
- SMTAV Ba12S Firmware: all versions
- SMTAV Ba20-N Firmware: all versions
- SMTAV Ba20S Firmware: all versions
- SMTAV Ba30-N Firmware: all versions
- SMTAV Ba30S Firmware: all versions
- SMTAV Bv20S Firmware: all versions
- SMTAV Bv30S Firmware: all versions
- SMTAV Bx20N Firmware: all versions
- SMTAV Bx20S-Sh Firmware: all versions
- SMTAV Bx20Uhd-N Firmware: all versions
- SMTAV Bx20Uhd Firmware: all versions
- SMTAV Bx30S Firmware: all versions
- SMTAV Hd17H-N Firmware: all versions
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10
- https://www.cve.org/CVERecord?id=CVE-2025-35451
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/
Get alerted when CVE-2025-35451 or the next vulnerability affects your stack