Critical severity · published Sep 5, 2025
CVE-2025-35451
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1F
12x Fixed Camera/NDI Fixed Camera · PTZOptics
before 7.2.85 · source: vendor
2F
20x Fixed Camera/NDI Fixed Camera · PTZOptics
before 7.2.94 · source: vendor
EF
EPTZ Fixed Camera/NDI Fixed Camera · PTZOptics
before 8.1.89 · source: vendor
HC
HC-EPTZ-NDI · PTZOptics
before 8.2.14 · source: vendor
PT
PT-STUDIOPRO · PTZOptics
before 9.0.41 · source: vendor
PT
PT12X-4K-xx-G3 · PTZOptics
before 0.0.58 · source: vendor
PT
PT12X-LINK-4K-xx · PTZOptics
before 0.0.63 · source: vendor
PT
PT12X-SDI/NDI-xx · PTZOptics
before 6.3.70 · source: vendor
PT
PT12X-SE-xx-G3 · PTZOptics
before 9.1.43 · source: vendor
PT
PT12X-STUDIO-4K-xx-G3 · PTZOptics
before 8.1.90 · source: vendor
PT
PT12X-USB-xx · PTZOptics
before 6.2.88 · source: vendor
PT
PT20X-4K-xx-G3 · PTZOptics
before 0.0.85 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-35451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-35451
Third Party Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35451
Third Party Advisory
https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
Exploit
https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/
More from Pan-Tilt-Zoom Cameras
9.8
CVE-2025-35452
Pan-Tilt-Zoom cameras default administrative credentials for web interface