CVE-2025-35452: critical vulnerability in multiCAM Systems Pan-Tilt-Zoom Cameras
Pan-Tilt-Zoom cameras default administrative credentials for web interface
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
PTZOptics and similar cameras come with default administrator usernames and passwords for their web interface that are the same across all devices. An attacker can access the camera's controls and settings without authorization, potentially viewing feeds, changing configurations, or disabling security features.
These pan-tilt-zoom cameras fail to enforce unique or changed default credentials on the administrative web interface (CWE-798: Use of Hard-coded Credentials). An unauthenticated attacker on the network can authenticate using publicly known default credentials, gaining full administrative access to the camera's configuration, video streams, and remote control functions. This affects PTZOptics and ValueHD-based devices with no enforcement of credential rotation.
In the same product, most dangerous first.