CVE-2025-35452 Pan-Tilt-Zoom cameras default administrative credentials for web interface
Attackers can gain administrative access to PTZ cameras using default shared credentials, allowing full control over the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35452?
CVE-2025-35452 is a critical vulnerability in PTZOptics 12x Fixed Camera/NDI Fixed Camera, published on 5 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
Which versions are affected by CVE-2025-35452?
It affects 61 products.
Products include Multicam-Systems Mcamii Ptz Firmware, Ptzoptics Ndi Fixed Camera Firmware, Ptzoptics Pt-Studiopro Firmware, Ptzoptics Pt12x-4k-Xx-G3 Firmware, Ptzoptics Pt12x-Link-4k-Xx Firmware, Ptzoptics Pt12x-Ndi-Xx Firmware and 55 more.
How do I fix CVE-2025-35452?
No fix has been published for CVE-2025-35452 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35452 being exploited?
There is no known exploitation of CVE-2025-35452 in the wild and no public exploit code.
Other vulnerabilities in PTZOptics 12x Fixed Camera/NDI Fixed Camera
Sources
Also known as GHSA-gx6v-756j-7g8w.