CVE-2025-35452CWE-1392CWE-798

Pan-Tilt-Zoom cameras default administrative credentials for web interface

Critical · published September 5, 2025

CVSS v4.0
9.2
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

🚨 Default credentials are still the name of the game with these cameras! PTZOptics and other ValueHD-based pan-tilt-zoom cameras come with shared admin login details that could let anyone take full control! 🔥 Think of these cameras as a high-tech security guard with a keycard that anyone can borrow. If the guard never checks who has the key, it's only a matter of time before an intruder swings by to take a peek inside! An attacker could waltz right into your surveillance system, gain unauthorized access, and manipulate the cameras at will. This means they could spy on sensitive areas, tamper with recordings, or even disable the cameras entirely, which could be absolutely devastating for security!

Put simply

Think of these cameras as a high-tech security guard with a keycard that anyone can borrow. If the guard never checks who has the key, it's only a matter of time before an intruder swings by to take a peek inside! This vulnerability arises from default, shared credentials for the administrative web interface of PTZOptics and potentially other ValueHD-based cameras, allowing unauthorized users to gain complete control over the device.

What to do

An attacker could waltz right into your surveillance system, gain unauthorized access, and manipulate the cameras at will. This means they could spy on sensitive areas, tamper with recordings, or even disable the cameras entirely, which could be absolutely devastating for security! Change the default administrative credentials immediately to unique, strong passwords. Additionally, consider implementing network segmentation to limit access to these cameras and keep an eye out for firmware updates from the manufacturer that address this issue. You've got this! Just follow these steps, and you’ll be the hero that tightens up your camera security! 🛡️

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00851 · 57.8th percentile
Weaknesses
CWE-1392 · Use of Default Credentials; CWE-798 · Use of Hard-coded Credentials
Published
2025-09-05T17:49Z
EPSS history
Timeline
  • 05 SEP 17:49Z
    Pan-Tilt-Zoom cameras default administrative credentials for web interface
    cvelistv5