CRITICAL
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
Published Sep 5, 2025
9.3
CRITICALCVSS 4.0
EPSS 0.77%
Description
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Affected products
-
- Version 0StatusaffectedConstraints<7.2.85
- Version 7.2.85StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<7.2.94
- Version 7.2.94StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<8.1.89
- Version 8.1.89StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<8.2.14
- Version 8.2.14StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<9.0.41
- Version 9.0.41StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<0.0.58
- Version 0.0.58StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<0.0.63
- Version 0.0.63StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<6.3.70
- Version 6.3.70StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<9.1.43
- Version 9.1.43StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<8.1.90
- Version 8.1.90StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<6.2.88
- Version 6.2.88StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<0.0.85
- Version 0.0.85StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<0.0.89
- Version 0.0.89StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<6.3.27
- Version 6.3.27StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<9.1.32
- Version 9.1.32StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<8.1.90
- Version 8.1.90StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<6.2.81
- Version 6.2.81StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<2.0.64
- Version 2.0.64StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<2.0.71
- Version 2.0.71StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<6.3.43
- Version 6.3.43StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<9.1.33
- Version 9.1.33StatusunaffectedConstraints-
- Version
-
- Version 0StatusaffectedConstraints<7.2.94
- Version 7.2.94StatusunaffectedConstraints-
- Version
-
-
-
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| PTZOptics | 12x Fixed Camera/NDI Fixed Camera | n/a |
| |||||||||
| PTZOptics | 20x Fixed Camera/NDI Fixed Camera | n/a |
| |||||||||
| PTZOptics | EPTZ Fixed Camera/NDI Fixed Camera | n/a |
| |||||||||
| PTZOptics | HC-Eptz-Ndi | n/a |
| |||||||||
| PTZOptics | PT-Studiopro | n/a |
| |||||||||
| PTZOptics | PT12X-4K-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT12X-LINK-4K-xx | n/a |
| |||||||||
| PTZOptics | PT12X-SDI/NDI-xx | n/a |
| |||||||||
| PTZOptics | PT12X-SE-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT12X-STUDIO-4K-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT12X-USB-xx | n/a |
| |||||||||
| PTZOptics | PT20X-4K-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT20X-LINK-4K-xx | n/a |
| |||||||||
| PTZOptics | PT20X-SDI/NDI-xx | n/a |
| |||||||||
| PTZOptics | PT20X-SE-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT20X-STUDIO-4K-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT20X-USB-xx | n/a |
| |||||||||
| PTZOptics | PT30X-4K-xx-G3 | n/a |
| |||||||||
| PTZOptics | PT30X-LINK-4K-xx | n/a |
| |||||||||
| PTZOptics | PT30X-SDI/NDI-xx | n/a |
| |||||||||
| PTZOptics | PT30X-SE-xx-G3 | n/a |
| |||||||||
| PTZOptics | VL Fixed Camera/NDI Fixed Camera | n/a |
| |||||||||
| Smtav | Pan-Tilt-Zoom Cameras | n/a |
| |||||||||
| ValueHD | Pan-Tilt-Zoom Cameras | n/a |
| |||||||||
| multiCAM Systems | Pan-Tilt-Zoom Cameras | n/a |
|
Configuration 1
AND
- ≤ 6.3.34
Running on/with
- n/a
Configuration 2
AND
- ≤ 6.3.34
Running on/with
- n/a
Configuration 3
AND
- ≤ 6.2.81
Running on/with
- n/a
Configuration 4
AND
- ≤ 6.3.20
Running on/with
- n/a
Configuration 5
AND
- ≤ 6.3.20
Running on/with
- n/a
Configuration 6
AND
- ≤ 6.2.73
Running on/with
- n/a
Configuration 7
AND
- ≤ 6.3.30
Running on/with
- n/a
Configuration 8
AND
- ≤ 6.3.30
Running on/with
- n/a
Configuration 9
AND
- ≤ 7.2.76
Running on/with
- n/a
Configuration 10
AND
- ≤ 7.2.82
Running on/with
- n/a
Configuration 11
AND
- ≤ 7.2.79
Configuration 12
AND
- ≤ 8.1.81
Running on/with
- n/a
Configuration 13
AND
- ≤ 8.1.81
Running on/with
- n/a
Configuration 14
AND
- ≤ 7.2.94
Running on/with
- n/a
Configuration 15
AND
- ≤ 7.2.94
Running on/with
- n/a
Configuration 16
AND
- n/a
Running on/with
- n/a
Configuration 17
AND
- n/a
Configuration 18
AND
- n/a
Configuration 19
AND
- n/a
Configuration 20
AND
- n/a
Configuration 21
AND
- n/a
Configuration 22
AND
- n/a
Configuration 23
AND
- n/a
Configuration 24
AND
- n/a
Configuration 25
AND
- n/a
Configuration 26
AND
- n/a
Configuration 27
AND
- n/a
Configuration 28
AND
- n/a
Configuration 29
AND
- n/a
Configuration 30
AND
- n/a
Configuration 31
AND
- n/a
Configuration 32
AND
- n/a
Configuration 33
AND
- n/a
Configuration 34
AND
- n/a
Configuration 35
AND
- n/a
Configuration 36
AND
- n/a
Configuration 37
AND
- n/a
Configuration 38
AND
- n/a
Configuration 39
AND
- n/a
Configuration 40
AND
- n/a
Configuration 41
AND
- n/a
Configuration 42
AND
- n/a
Configuration 43
AND
- n/a
Configuration 44
AND
- n/a
Configuration 45
AND
- n/a
Configuration 46
AND
- n/a
Configuration 47
AND
- n/a
Configuration 48
AND
- n/a
Configuration 49
AND
- n/a
Configuration 50
AND
- n/a
Configuration 51
AND
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27022 Advisory
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json Third Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10 Third Party AdvisoryUS Government Resource
- https://www.cve.org/CVERecord?id=CVE-2025-35451 Third Party Advisory
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai Third Party Advisory
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ ExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27022 | Advisory | |
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json | Third Party Advisory | |
| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10 | Third Party AdvisoryUS Government Resource | |
| https://www.cve.org/CVERecord?id=CVE-2025-35451 | Third Party Advisory | |
| https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai | Third Party Advisory | |
| https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ | ExploitThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisa-cg
Published Sep 5, 2025
Updated Sep 8, 2025
Reserved Apr 15, 2025
Link CVE-2025-35451
CISA Vulnrichment
Updated Sep 8, 2025
ENISA EUVD
EUVD-2025-27022 Assigner cisa-cg
Published Sep 5, 2025
Updated Sep 8, 2025
Exploited since n/a
Link EUVD-2025-27022