What’s Vulnerable › Vulnerabilities

CVE-2025-35452: Pan-Tilt-Zoom cameras default administrative credentials for web interface

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-05 · updated 2026-06-17
• Weakness: CWE-798

Description

PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.

Affected products

• Multicam-Systems Mcamii Ptz Firmware: all versions
• PTZOptics Ndi Fixed Camera Firmware: through 7.2.94
• PTZOptics Pt-Studiopro Firmware: through 9.0.41
• PTZOptics Pt12X-4K-Xx-G3 Firmware: through 0.0.58
• PTZOptics Pt12X-Link-4K-Xx Firmware: through 0.0.63
• PTZOptics Pt12X-Ndi-Xx Firmware: all versions
• PTZOptics Pt12X-Sdi-Xx-G2 Firmware: all versions
• PTZOptics Pt12X-Se-Xx-G3 Firmware: through 9.1.43
• PTZOptics Pt12X-Usb-Xx-G2 Firmware: all versions
• PTZOptics Pt12X-Zcam Firmware: all versions
• PTZOptics Pt20X-4K-Xx-G3 Firmware: through 0.0.85
• PTZOptics Pt20X-Link-4K-Xx Firmware: through 0.0.89
• PTZOptics Pt20X-Sdi-Xx-G2 Firmware: all versions
• PTZOptics Pt20X-Se-Xx-G3 Firmware: through 9.1.32
• PTZOptics Pt20X-Usb-Xx-G2 Firmware: all versions
• PTZOptics Pt20X-Zcam Firmware: all versions
• PTZOptics Pt30X-4K-Xx-G3 Firmware: through 2.0.64
• PTZOptics Pt30X-Link-4K-Xx Firmware: through 2.0.71
• PTZOptics Pt30X-Ndi-Xx Firmware: all versions
• PTZOptics Pt30X-Sdi-Xx-G2 Firmware: all versions
• PTZOptics Pt30X-Se-Xx-G3 Firmware: through 9.1.33
• PTZOptics Pteptz-Ndi-Zcam-G2: all versions
• PTZOptics Pteptz-Zcam-G2 Firmware: all versions
• PTZOptics Ptvl-Zcam Firmware: all versions
• PTZOptics T20X-Ndi-Xx Firmware: all versions
• PTZOptics Vl Fixed Camera Firmware: through 7.2.94
• SMTAV Ba12-N Firmware: all versions
• SMTAV Ba12S Firmware: all versions
• SMTAV Ba20-N Firmware: all versions
• SMTAV Ba20S Firmware: all versions

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10
• https://www.cve.org/CVERecord?id=CVE-2025-35452
• https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
• https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/

Get alerted when CVE-2025-35452 or the next vulnerability affects your stack