Introduction
Unauthorized remote access to surveillance infrastructure has led to real-world breaches in critical manufacturing, healthcare, and government sectors. The default, hard-coded administrative credentials recently found in PTZOptics and ValueHD-based pan-tilt-zoom cameras (CVE-2025-35452) show how one design flaw can expose an entire organization to remote compromise, persistent surveillance, and lateral movement.
PTZOptics is a leading manufacturer of professional PTZ cameras, which are widely used in broadcasting, education, and security. Its cameras are deployed worldwide, and many critical infrastructure and commercial environments depend on them. ValueHD supplies OEM camera platforms to several brands, so a flaw in its firmware spreads across all of them. The vulnerability also affects other vendors, including SMTAV and multiCAM Systems.
Technical information
CVE-2025-35452 is a critical vulnerability (CVSS 9.8) caused by default, hard-coded credentials in the web interface of PTZOptics and ValueHD-based PTZ cameras. On affected devices, a username and password set to a known default protect the administrative interface, typically:
Username: admin
Password: admin
In certain firmware versions, these credentials sit in plaintext in the firmware image, and the end user cannot change or disable them. Even after an administrator tries to update the password, the original hard-coded credentials still work for remote access. An attacker only has to connect to the camera's web interface over the network and log in with the default credentials to gain full administrative control. No user interaction is required, and exploitation can be automated at scale.
The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and CWE-1392 (Use of Default Credentials). Public advisories confirm that exploitation is trivial and needs no special tools or advanced techniques. Related issues in the same ecosystem, such as CVE-2024-8956 (improper authentication) and CVE-2025-35451 (hard-coded OS/telnet credentials), compound the flaw and can be chained for deeper compromise.
Affected systems and versions
CVE-2025-35452 is confirmed to affect these products and vendors:
- PTZOptics PTZ camera models with web interface firmware containing hard-coded admin credentials ("admin"/"admin").
- SMTAV PTZ camera models running ValueHD-based firmware with default credentials.
- multiCAM Systems PTZ cameras built on ValueHD platforms.
- ValueHD OEM PTZ camera platforms used by multiple brands.
The vulnerability is present in firmware versions where the admin credentials are hard-coded and the user cannot change or disable them. Public advisories do not list specific affected versions, but all ValueHD-based PTZ cameras with default credentials are considered vulnerable unless patched. PTZOptics has released patches for some models. Organizations should check the CISA advisory and vendor documentation for model-specific details.
Vendor security history
PTZOptics has responded to coordinated disclosure with firmware patches for some affected models, and it maintains a public vulnerability disclosure process. Earlier related vulnerabilities include:
- CVE-2024-8956: Improper authentication in PTZOptics and ValueHD-based cameras.
- CVE-2025-35451: Hard-coded OS/telnet credentials in the same ecosystem.
PTZOptics generally shows moderate security maturity and responds to public disclosures in a timely way. SMTAV and ValueHD, by contrast, have not responded to coordinated disclosure efforts and have issued no patches or public guidance. That raises concerns about their long-term security support and maturity.
