Vulnerability in Multicam Systems Pan-Tilt-Zoom Cameras
CVE-2025-35451
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Multicam Systems Pan-Tilt-Zoom Cameras
- Multicam-Systems Mcamii Ptz
- Multicam-Systems Mcamii Ptz Firmware
- Ptzoptics 12x Fixed Camera/ndi Camera — versions 0, 7.2.85
- Ptzoptics 20x Fixed Camera/ndi Camera — versions 0, 7.2.94
- Ptzoptics Eptz Fixed Camera/ndi Camera — versions 0, 8.1.89
- Ptzoptics Hc-Eptz-Ndi — versions 0, 8.2.14
- Ptzoptics Ndi Fixed Camera
- Ptzoptics Ndi Fixed Camera Firmware
- Ptzoptics Pt12x-4k-Xx-G3 — versions 0, 0.0.58
Weakness classification (CWE)
References
- 9119a7d8-5eab-497f-8521-727c672e3725 (US Government Resource, Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Exploit, Third Party Advisory)
- 9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-35451?
- CVE-2025-35451 is a critical-severity vulnerability in Multicam Systems Pan-Tilt-Zoom Cameras, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2025-09-05.
- How severe is CVE-2025-35451?
- Critical severity. CVSS v3 base score is 9.8 out of 10.