Multiple exploited critical vulnerabilities reported in PTZOptics and other Pan-Tilt-Zoom Cameras
Take action: If you have PTZOptics cameras (PT12X, PT20X, PT30X series) or pan-tilt-zoom cameras from ValueHD, multiCAM Systems, or SMTAV, make sure to isolate these devices from the internet as they're being actively exploited. Apply PTZOptics firmware updates, and reach out to your vendor. If no patches are available, consider replacing cameras from other vendors or enforcing strict network isolation.
Learn More
CISA is reporting multiple critical security vulnerabilities affecting PTZOptics and other pan-tilt-zoom camera systems from ValueHD, multiCAM Systems, and SMTAV. These flaws enable remote attackers to compromise devices without authentication and execute arbitrary commands on affected systems.
The vulnerabilities have been actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog with mandatory remediation deadlines for federal agencies.
Vulnerabilities summary
- CVE-2024-8956 (CVSS score 9.3) - An improper authentication vulnerability affecting PTZOptics PT30X-SDI/NDI cameras that allows remote attackers to bypass authentication controls and access sensitive configuration data including usernames, password hashes, and device settings without proper authorization.
- CVE-2024-8957 (CVSS score 8.6) - An OS command injection flaw that enables authenticated attackers to execute arbitrary operating system commands through insufficient validation of the ntp_addr configuration parameter.
- CVE-2025-35451 (CVSS score 9.2) - A hard-coded credentials vulnerability affecting SSH and telnet services that allows attackers to gain administrative access using default passwords that cannot be changed by users.
- CVE-2025-35452 (CVSS score 9.2) - Another hard-coded credentials issue affecting the administrative web interface with shared default passwords across devices.
Affected products
- PTZOptics camera models including the PT12X, PT20X, and PT30X series across SDI, NDI, USB, and 4K variants,
- ValueHD, multiCAM Systems, and SMTAV pan-tilt-zoom cameras are also affected by the hard-coded credential vulnerabilities across all versions.
PTZOptics has released firmware updates to address these vulnerabilities. The other vendors, ValueHD, multiCAM Systems, and SMTAV have not responded to CISA's coordination requests.
Organizations using affected camera systems are strongly advised to isolate the devices and patch when available.
