CVE-2025-35451

Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled

Critical9.3EPSS 0.80%

Published: 5 Sept 2025
Updated: 8 Sept 2025
Reserved: 15 Apr 2025
Assigned by: cisa-cg

Description

PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.

Scores

CVSS scores of CVE-2025-35451, by who scored it
Scored by	CVSS	Score	Vector
cisa-cgCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
cisa-cgCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.80% · top 43% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-798 Use of Hard-coded Credentials (opens in a new tab)All about CWE-798 and its CVEs

Affected products

PTZOptics · PT12X-SE-xx-G3
- affected < 9.1.43
- unaffected 9.1.43
PTZOptics · PT12X-LINK-4K-xx
- affected < 0.0.63
- unaffected 0.0.63
PTZOptics · PT20X-SE-xx-G3
- affected < 9.1.32
- unaffected 9.1.32
PTZOptics · PT20X-LINK-4K-xx
- affected < 0.0.89
- unaffected 0.0.89
PTZOptics · PT-STUDIOPRO
- affected < 9.0.41
- unaffected 9.0.41
PTZOptics · PT30X-SE-xx-G3
- affected < 9.1.33
- unaffected 9.1.33
PTZOptics · PT30X-LINK-4K-xx
- affected < 2.0.71
- unaffected 2.0.71
PTZOptics · PT12X-STUDIO-4K-xx-G3
- affected < 8.1.90
- unaffected 8.1.90
PTZOptics · PT20X-STUDIO-4K-xx-G3
- affected < 8.1.90
- unaffected 8.1.90
PTZOptics · PT12X-SDI/NDI-xx
- affected < 6.3.70
- unaffected 6.3.70
PTZOptics · PT12X-USB-xx
- affected < 6.2.88
- unaffected 6.2.88
PTZOptics · PT20X-SDI/NDI-xx
- affected < 6.3.27
- unaffected 6.3.27
SMTAV · Pan-Tilt-Zoom Cameras
- affected *
PTZOptics · PT30X-SDI/NDI-xx
- affected < 6.3.43
- unaffected 6.3.43
multiCAM Systems · Pan-Tilt-Zoom Cameras
- affected *
PTZOptics · VL Fixed Camera/NDI Fixed Camera
- affected < 7.2.94
- unaffected 7.2.94
PTZOptics · 12x Fixed Camera/NDI Fixed Camera
- affected < 7.2.85
- unaffected 7.2.85
PTZOptics · 20x Fixed Camera/NDI Fixed Camera
- affected < 7.2.94
- unaffected 7.2.94
PTZOptics · EPTZ Fixed Camera/NDI Fixed Camera
- affected < 8.1.89
- unaffected 8.1.89
PTZOptics · HC-EPTZ-NDI
- affected < 8.2.14
- unaffected 8.2.14
PTZOptics · PT12X-4K-xx-G3
- affected < 0.0.58
- unaffected 0.0.58
PTZOptics · PT20X-4K-xx-G3
- affected < 0.0.85
- unaffected 0.0.85
PTZOptics · PT20X-USB-xx
- affected < 6.2.81
- unaffected 6.2.81
PTZOptics · PT30X-4K-xx-G3
- affected < 2.0.64
- unaffected 2.0.64
ValueHD · Pan-Tilt-Zoom Cameras
- affected *

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-35451](https://trackcve.app/badge/CVE-2025-35451.svg)](https://trackcve.app/cve/CVE-2025-35451)

Record last updated 8 Sept 2025, 18:08 UTC.