Introduction
Remote attackers have gained root access to PTZOptics and ValueHD-based pan-tilt-zoom cameras in healthcare, government, and manufacturing environments by exploiting hard-coded administrative credentials. The credentials are embedded in the firmware, users cannot change them, and they give full control over SSH and telnet. The vulnerability, tracked as CVE-2025-35451, is actively targeted and has a CVSS v3 score of 9.8.
PTZOptics is a leading US-based provider of professional PTZ cameras, used widely in broadcasting, conferencing, and surveillance. ValueHD, a major OEM in China, supplies the underlying hardware and firmware for PTZOptics and for other brands, including multiCAM Systems and SMTAV. These cameras are deployed worldwide in critical infrastructure sectors.
Technical Information
CVE-2025-35451 is a critical authentication flaw caused by hard-coded administrative credentials in the firmware of PTZOptics and ValueHD-based cameras. The affected devices have SSH (port 22) and telnet (port 23) enabled on all interfaces by default. Every device running vulnerable firmware uses the same credentials, and end users cannot change or remove them.
Attackers can find vulnerable devices by scanning for open SSH or telnet ports. Once they find one, they can authenticate with the known credentials and get root access to the underlying Linux operating system. That gives them full administrative control, including the ability to:
- Modify device configurations
- Install or remove software
- Extract sensitive data
- Establish persistent backdoors
- Use the camera as a pivot point for lateral movement within the network
The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials). The root cause is static credentials embedded in the firmware image. This is a critical design flaw, and configuration changes alone cannot mitigate it. The only effective remediation is a firmware update that removes or randomizes the credentials and lets users set their own passwords.
There are no public code snippets for the hard-coded credentials, but security advisories confirm that they are trivial to crack and widely known in the security community.
Affected Systems and Versions
- PTZOptics cameras running firmware versions prior to 6.3.40
- ValueHD-based cameras from ValueHD, multiCAM Systems, and SMTAV (all firmware versions as of the latest advisories)
- All configurations where SSH or telnet is enabled (the default state)
- Devices exposed to the internet or reachable from untrusted networks, which are at highest risk
Vendor Security History
PTZOptics has addressed earlier vulnerabilities in its camera firmware, including improper authentication and OS command injection (CVE-2024-8956, CVE-2024-8957). Its firmware updates and changelogs document security improvements such as HTTP Digest Authentication and guest login disabled by default. PTZOptics has generally responded to disclosures with timely patches.
ValueHD, multiCAM Systems, and SMTAV have not consistently responded to coordinated vulnerability disclosure, and many of their devices remain unpatched and vulnerable. The OEM supply chain model has left persistent vulnerabilities across multiple brands and product lines.
