CVE-2025-35451 Details

A vulnerability exists in PTZOptics and other ValueHD-based pan-tilt-zoom cameras, all versions prior to 6.3.40, excluding certain models, which use hard-coded default administrative passwords. These passwords, easily cracked, grant access to the admin web interface and, when combined with other vulnerabilities, allow for remote code execution. Many of these cameras have SSH or telnet enabled by default, listening on all interfaces. The default passwords for SSH and telnet can be easily cracked, but users cannot change these passwords or disable the SSH or telnet services. The vulnerability arises from improper authentication and the use of hard-coded credentials, which can be exploited to access sensitive data and execute arbitrary commands on the devices.

PTZOptics has released firmware updates addressing these vulnerabilities. Affected users should contact ValueHD, multiCAM Systems, or SMTAV for guidance on securing their devices.