CVE-2025-35452: PTZOptics PT12x Firmware Auth Bypass Flaw

CVE-2025-35452 Overview

CVE-2025-35452 is a hardcoded credentials vulnerability affecting PTZOptics and other ValueHD-based pan-tilt-zoom (PTZ) cameras. These network-connected surveillance and broadcast cameras ship with default, shared credentials for their administrative web interface, allowing unauthorized remote attackers to gain full administrative control over affected devices without requiring any prior authentication or user interaction.

This vulnerability represents a significant security risk for organizations deploying these cameras in corporate environments, broadcast studios, houses of worship, educational institutions, and other venues where PTZ cameras are commonly used for live streaming and video conferencing applications.

Critical Impact

Attackers can remotely authenticate to affected cameras using publicly known default credentials, gaining complete administrative control to manipulate camera settings, access video feeds, pivot to internal networks, or disable surveillance capabilities.

Affected Products

• PTZOptics PT12x, PT20x, and PT30x series cameras (SDI, NDI, USB, 4K, LINK, SE, and ZCAM variants)
• PTZOptics StudioPro, VL Fixed Camera, and NDI Fixed Camera
• Multicam-Systems MCAMII PTZ
• SMTAV BA, BV, BX, and HD series cameras
• ValueHD VX and V series cameras

Discovery Timeline

• September 5, 2025 - CVE-2025-35452 published to NVD
• December 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-35452

Vulnerability Analysis

This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), a common weakness in IoT and embedded device firmware. The affected PTZ cameras are manufactured using a shared firmware base from ValueHD, meaning the default credentials issue propagates across multiple vendors and dozens of camera models.

The administrative web interface provides full control over camera operations including pan, tilt, zoom controls, video streaming configuration, network settings, firmware updates, and user management. An attacker who authenticates with the default credentials gains unrestricted access to all these functions.

The attack requires no user interaction and can be executed remotely over the network. While the attack complexity requires some preconditions (network access to the camera's web interface), the widespread deployment of these cameras in internet-accessible configurations significantly increases the exploitability of this vulnerability.

Root Cause

The root cause is the use of hardcoded default credentials that are shared across all devices of the same model and are publicly documented in user manuals. The firmware does not enforce or require credential changes upon initial setup, and many deployments retain these factory defaults. This design flaw reflects a common insecure practice in IoT device manufacturing where convenience is prioritized over security.

Attack Vector

The attack vector is network-based, targeting the HTTP/HTTPS administrative web interface exposed by these cameras. An attacker can exploit this vulnerability through the following steps:

1. Discovery of vulnerable cameras via network scanning or internet-wide scans (e.g., Shodan, Censys)
2. Identification of the camera model through HTTP response headers or web interface characteristics
3. Authentication attempt using the publicly known default credentials for that model
4. Upon successful authentication, the attacker gains full administrative access

The cameras are often deployed with minimal network segmentation, and many are directly exposed to the internet for remote management or live streaming purposes. Research by GreyNoise Intelligence has documented active scanning and exploitation attempts targeting PTZOptics cameras in the wild, as detailed in their zero-day vulnerability research.

Detection Methods for CVE-2025-35452

Indicators of Compromise

• Unexpected configuration changes on PTZ cameras including modified network settings, streaming destinations, or user accounts
• Authentication logs showing successful logins during unusual hours or from unexpected IP addresses
• New or modified user accounts on camera administrative interfaces that were not created by authorized personnel
• Changes to camera positioning, presets, or automated movement patterns without administrative action

Detection Strategies

• Monitor network traffic for authentication attempts to PTZ camera web interfaces, particularly from external IP addresses
• Implement honeypot cameras with default credentials to detect active scanning and exploitation attempts
• Conduct regular credential audits to identify cameras still using factory default authentication
• Deploy network intrusion detection rules to alert on HTTP requests to known PTZ camera administrative endpoints

Monitoring Recommendations

• Enable and centralize logging from all PTZ camera devices to detect unauthorized access attempts
• Configure alerts for any successful authentication to camera web interfaces from non-whitelisted IP addresses
• Periodically scan internal networks and internet-facing assets to identify cameras with default credentials
• Monitor for unusual outbound traffic from camera IP addresses that could indicate compromise and lateral movement

How to Mitigate CVE-2025-35452

Immediate Actions Required

• Change default administrative credentials on all affected PTZ cameras immediately with strong, unique passwords
• Conduct an inventory of all PTZOptics, SMTAV, ValueHD, and Multicam-Systems cameras deployed in your environment
• Isolate cameras from direct internet access and place them on segmented VLANs with appropriate access controls
• Implement network-level authentication (VPN, zero-trust access) for remote camera management

Patch Information

Consult the CISA ICS Advisory ICSA-25-162-10 for specific firmware update information and vendor guidance. Check with individual vendors (PTZOptics, SMTAV, ValueHD, Multicam-Systems) for updated firmware that may address this credential management issue or enforce credential changes on first use.

Workarounds

• Place all PTZ cameras behind a firewall with strict ingress rules limiting administrative access to authorized management workstations only
• Disable remote administration via the web interface if not operationally required
• Implement network access control (NAC) to prevent unauthorized devices from communicating with camera management interfaces
• Use a VPN or jump host for all remote camera administration rather than exposing web interfaces directly

# Example: Block external access to camera web interfaces using iptables
# Replace 192.168.10.0/24 with your camera subnet
# Replace 10.0.0.50 with your management workstation IP

# Drop all external traffic to camera HTTP/HTTPS ports
iptables -A FORWARD -d 192.168.10.0/24 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.10.0/24 -p tcp --dport 443 -j DROP

# Allow only management workstation to access cameras
iptables -I FORWARD -s 10.0.0.50 -d 192.168.10.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -s 10.0.0.50 -d 192.168.10.0/24 -p tcp --dport 443 -j ACCEPT