Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled

Summary

PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.

Timeline

1. Sep 5, 2025, 5:43 PM UTCCVE published
2. Sep 8, 2025, 6:08 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Sep 8, 2025, 6:08 PM UTCRecord last updated

Affected versions

• PTZOptics PT12X-SE-xx-G3

  fixed in 9.1.43

• PTZOptics PT12X-LINK-4K-xx

  fixed in 0.0.63

• PTZOptics PT20X-SE-xx-G3

  fixed in 9.1.32

• PTZOptics PT20X-LINK-4K-xx

  fixed in 0.0.89

• PTZOptics PT-STUDIOPRO

  fixed in 9.0.41

• PTZOptics PT30X-SE-xx-G3

  fixed in 9.1.33

• PTZOptics PT30X-LINK-4K-xx

  fixed in 2.0.71

• PTZOptics PT12X-STUDIO-4K-xx-G3

  fixed in 8.1.90

• PTZOptics PT20X-STUDIO-4K-xx-G3

  fixed in 8.1.90

• PTZOptics PT12X-SDI/NDI-xx

  fixed in 6.3.70

• PTZOptics PT12X-USB-xx

  fixed in 6.2.88

• PTZOptics PT20X-SDI/NDI-xx

  fixed in 6.3.27

• SMTAV Pan-Tilt-Zoom Cameras

  All versions

• PTZOptics PT30X-SDI/NDI-xx

  fixed in 6.3.43

• multiCAM Systems Pan-Tilt-Zoom Cameras

  All versions

• PTZOptics VL Fixed Camera/NDI Fixed Camera

  fixed in 7.2.94

• PTZOptics 12x Fixed Camera/NDI Fixed Camera

  fixed in 7.2.85

• PTZOptics 20x Fixed Camera/NDI Fixed Camera

  fixed in 7.2.94

• PTZOptics EPTZ Fixed Camera/NDI Fixed Camera

  fixed in 8.1.89

• PTZOptics HC-EPTZ-NDI

  fixed in 8.2.14

• PTZOptics PT12X-4K-xx-G3

  fixed in 0.0.58

• PTZOptics PT20X-4K-xx-G3

  fixed in 0.0.85

• PTZOptics PT20X-USB-xx

  fixed in 6.2.81

• PTZOptics PT30X-4K-xx-G3

  fixed in 2.0.64

• ValueHD Pan-Tilt-Zoom Cameras

  All versions

References 5