Vulnerability in Multicam Systems Pan-Tilt-Zoom Cameras
CVE-2025-35451
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
EPSS: 0.007 (50.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Multicam Systems Pan-tilt-zoom Cameras
- Multicam-systems Mcamii_ptz
- Multicam-systems Mcamii_ptz_firmware
- Ptzoptics 12x Fixed Camera/ndi Camera — versions 0, 7.2.85
- Ptzoptics 20x Fixed Camera/ndi Camera — versions 0, 7.2.94
- Ptzoptics Eptz Fixed Camera/ndi Camera — versions 0, 8.1.89
- Ptzoptics Hc-eptz-ndi — versions 0, 8.2.14
- Ptzoptics Ndi_fixed_camera
- Ptzoptics Ndi_fixed_camera_firmware
- Ptzoptics Pt12x-4k-xx-g3 — versions 0, 0.0.58
Weakness classification (CWE)
References
- 9119a7d8-5eab-497f-8521-727c672e3725 (US Government Resource, Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Exploit, Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-35451?
- CVE-2025-35451 is a critical-severity vulnerability in Multicam Systems Pan-Tilt-Zoom Cameras, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2025-09-05.
- How severe is CVE-2025-35451?
- Critical severity. CVSS v3 base score is 9.8 out of 10.