← back
CVE-2025-35452

Pan-Tilt-Zoom cameras default administrative credentials for web interface

CVSS 9.2 CRITICALEPSS 0.8%CWE-1392CWE-798
In short

PTZOptics and similar cameras come with default administrator usernames and passwords for their web interface that are the same across all devices. An attacker can access the camera's controls and settings without authorization, potentially viewing feeds, changing configurations, or disabling security features.

Technical detail

These pan-tilt-zoom cameras fail to enforce unique or changed default credentials on the administrative web interface (CWE-798: Use of Hard-coded Credentials). An unauthenticated attacker on the network can authenticate using publicly known default credentials, gaining full administrative access to the camera's configuration, video streams, and remote control functions. This affects PTZOptics and ValueHD-based devices with no enforcement of credential rotation.

Summary generated and translated by AI from the official description.
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →