CVE-2025-35452
Published: 05 September 2025
Summary
CVE-2025-35452 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Ptzoptics Pteptz-Ndi-Zcam-G2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique SSH (T1021.004); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-2 requires changing default content of system accounts and automatically assigned passwords, directly mitigating the use of default shared administrative credentials in PTZOptics cameras.
IA-5 mandates management of authenticators like passwords with requirements for uniqueness, strength, and non-reuse of defaults, preventing exploitation of hard-coded or shared credentials.
CM-6 enforces secure configuration settings including modification of default credentials to the most restrictive mode consistent with operational needs for affected camera devices.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Default and hard-coded credentials for web admin, SSH, and Telnet enable T1078.001 (Default Accounts) and T1021.004 (SSH). Improper authentication and OS command injection in the web interface (/cgi-bin/param.cgi, ntp_addr) facilitate T1190 (Exploit Public-Facing Application) and T1059.004 (Unix Shell).
NVD Description
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
Deeper analysisAI
CVE-2025-35452 is a critical vulnerability in PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras, stemming from the use of default, shared credentials for the administrative web interface. This issue maps to CWE-798 (use of hard-coded credentials) and CWE-1392 (use of default credentials), with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network-accessible exploitation without authentication or user interaction.
Remote, unauthenticated attackers can exploit this vulnerability by connecting to the camera's web interface over the network and using the publicly known default credentials to gain administrative access. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, enabling full control over the affected camera devices.
CISA's ICSA-25-162-10 advisory details mitigations for this and related vulnerabilities in operational technology devices. Additional guidance appears in the official CVE record and GreyNoise publications.
GreyNoise intelligence reports the discovery of zero-day vulnerabilities, including this one, in live-streaming cameras using AI assistance, with further details on related RCE in their SIFT analysis.
Details
- CWE(s)