Skip to content
OpenAdvisories
Critical 2 exploited CVEs ICSA-25-162-10 4 CVEs

PTZOptics and Other Pan-Tilt-Zoom Cameras

Published Jun 12, 2025 · Updated Jun 12, 2025

Vendor: ValueHD, PTZOptics, multiCAM Systems, SMTAV Product: multiCAM Systems Pan-Tilt-Zoom Cameras Product: PTZOptics PT-STUDIOPRO Product: PTZOptics PT12X-4K-xx-G3 Product: PTZOptics PT12X-LINK-4K-xx Product: PTZOptics PT12X-NDI-xx Product: PTZOptics PT12X-SDI-xx-G2 Product: PTZOptics PT12X-SE-xx-G3 Product: PTZOptics PT12X-USB-xx-G2 Product: PTZOptics PT12X-ZCAM Product: PTZOptics PT20X-4K-xx-G3 Product: PTZOptics PT20X-LINK-4K-xx Product: PTZOptics PT20X-NDI-xx Product: PTZOptics PT20X-SDI-xx-G2 Product: PTZOptics PT20X-SE-xx-G3 Product: PTZOptics PT20X-USB-xx-G2 Product: PTZOptics PT20X-ZCAM Product: PTZOptics PT30X-4K-xx-G3 Product: PTZOptics PT30X-LINK-4K-xx Product: PTZOptics PT30X-NDI-xx Product: PTZOptics PT30X-SDI-xx-G2 Product: PTZOptics PT30X-SE-xx-G3 Product: PTZOptics PTEPTZ-NDI-ZCAM-G2 Product: PTZOptics PTEPTZ-ZCAM-G2 Product: PTZOptics PTVL-ZCAM Product: PTZOptics PTZOptics VL Fixed Camera/NDI Fixed Camera Product: PTZOpticsPT20X-NDI-xx Product: SMTAV Pan-Tilt-Zoom Cameras Product: ValueHD Pan-Tilt-Zoom Cameras

Summary

Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.

Vulnerabilities 4

  • Critical 9.1
    CVE-2024-8956 Exploited EPSS 59%

    PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a rem…

    PTZOptics PT30X-SDI PT30X-NDI
    KEV Nov 4, 2024
  • High 7.2
    CVE-2024-8957 Exploited EPSS 80%

    PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained…

    PTZOptics PT30X-SDI PT30X-NDI
    KEV Nov 4, 2024
  • Critical 9.8
    CVE-2025-35451

    Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled

    PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user…

    PTZOptics multiCAM Systems ValueHD SMTAV
  • Critical 9.8
    CVE-2025-35452

    Pan-Tilt-Zoom cameras default administrative credentials for web interface

    PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.

    PTZOptics multiCAM Systems ValueHD SMTAV

Revision history

  1. #1

    Initial Publication

References