CVE-2025-35451
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725
- Published
- 2025-09-05
- Last modified
- 2025-09-08
- Weaknesses
- CWE-798
Affected products
- Mcamii Ptz Firmware (Multicam-systems)
- Pan-tilt-zoom Cameras (Multicam Systems)
- 12x Fixed Camerandi Fixed Camera (Ptzoptics)
- 20x Fixed Camerandi Fixed Camera (Ptzoptics)
- Eptz Fixed Camerandi Fixed Camera (Ptzoptics)
- Hc-eptz-ndi (Ptzoptics)
- Ndi Fixed Camera Firmware (Ptzoptics)
- Pt-studiopro (Ptzoptics)
- Pt12x-4k-xx-g3 (Ptzoptics)
- Pt12x-link-4k-xx (Ptzoptics)
- Pt12x-ndi-xx Firmware (Ptzoptics)
- Pt12x-sdi-xx-g2 Firmware (Ptzoptics)
- Pt12x-sdindi-xx (Ptzoptics)
- Pt12x-se-xx-g3 (Ptzoptics)
- Pt12x-studio-4k-xx-g3 (Ptzoptics)
- Pt12x-usb-xx (Ptzoptics)
- Pt12x-usb-xx-g2 Firmware (Ptzoptics)
- Pt12x-zcam Firmware (Ptzoptics)
- Pt20x-4k-xx-g3 (Ptzoptics)
- Pt20x-link-4k-xx (Ptzoptics)
- Pt20x-ndi-xx Firmware (Ptzoptics)
- Pt20x-sdi-xx-g2 Firmware (Ptzoptics)
- Pt20x-sdindi-xx (Ptzoptics)
- Pt20x-se-xx-g3 (Ptzoptics)
- Pt20x-studio-4k-xx-g3 (Ptzoptics)
- Pt20x-usb-xx (Ptzoptics)
- Pt20x-usb-xx-g2 Firmware (Ptzoptics)
- Pt20x-zcam Firmware (Ptzoptics)
- Pt30x-4k-xx-g3 (Ptzoptics)
- Pt30x-link-4k-xx (Ptzoptics)
- Pt30x-ndi-xx Firmware (Ptzoptics)
- Pt30x-sdi-xx-g2 Firmware (Ptzoptics)
- Pt30x-sdindi-xx (Ptzoptics)
- Pt30x-se-xx-g3 (Ptzoptics)
- Pteptz-ndi-zcam-g2 Firmware (Ptzoptics)
- Pteptz-zcam-g2 Firmware (Ptzoptics)
- Ptvl-zcam Firmware (Ptzoptics)
- Vl Fixed Camera Firmware (Ptzoptics)
- Vl Fixed Camerandi Fixed Camera (Ptzoptics)
- Ba12-n Firmware (Smtav)
- Ba12s Firmware (Smtav)
- Ba20-n Firmware (Smtav)
- Ba20s Firmware (Smtav)
- Ba30-n Firmware (Smtav)
- Ba30s Firmware (Smtav)
- Bv20s Firmware (Smtav)
- Bv30s Firmware (Smtav)
- Bx20n Firmware (Smtav)
- Bx20s-sh Firmware (Smtav)
- Bx20uhd-n Firmware (Smtav)
- Bx20uhd Firmware (Smtav)
- Bx30s Firmware (Smtav)
- Hd17h-n Firmware (Smtav)
- Hd17h Firmware (Smtav)
- Pan-tilt-zoom Cameras (Smtav)
- Pan-tilt-zoom Cameras (Valuehd)
- V60xl Firmware (Valuehd)
- V61w Firmware (Valuehd)
- V63xl Firmware (Valuehd)
- V71uvs Firmware (Valuehd)
- Vx60al Firmware (Valuehd)
- Vx60asl Firmware (Valuehd)
- Vx61al Firmware (Valuehd)
- Vx61asl Firmware (Valuehd)
- Vx61basl Firmware (Valuehd)
- Vx630al Firmware (Valuehd)
- Vx701ra Firmware (Valuehd)
- Vx701ta Firmware (Valuehd)
- Vx70uvs Firmware (Valuehd)
- Vx71uvs Firmware (Valuehd)
- Vx720l Firmware (Valuehd)
- Vx751ba Firmware (Valuehd)
- Vx752a Firmware (Valuehd)
- Vx752ag Firmware (Valuehd)
- Vx800i2 Firmware (Valuehd)
- Vx90 Firmware (Valuehd)
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10
- https://www.cve.org/CVERecord?id=CVE-2025-35451
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-…
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/
