The PTZOptics team was alerted to two Common Vulnerabilities & Exposures (CVE-2025-8671 and CVE-2025-54500) that may affect the PTZOptics cameras. When paired together, the identified vulnerabilities allow for a Denial-of-Service attack (DoS) on a device using lighttpd web server.

Updated 09/22/2025
An earlier update to this page noted two Common Vulnerabilities and Exposures (CVEs) actively affecting the cameras: CVE-225-8617 and CVE-2025-25500. These two CVEs allowed for Denial-of-Service (DoS) attacks through vulnerabilities in the HTTP/2 module of the lighttpd web server. After a thorough investigation it was determined that no actively sold cameras are vulnerable to either CVE. We do not include the HTTP/2 module in the lighttpd server on these cameras.

The PTZOptics team was alerted by CISA & Carnegie Mellon University (through their VINCE program) to two security vulnerabilities in previous firmware of PTZOptics cameras as noted in Common Vulnerabilities and Exposures report CVE-2025-35451 & CVE-2025-35452. The identified vulnerabilities allow unauthorized access to sensitive information and control over the cameras. The PTZOptics team tested these vulnerabilities against every PTZOptics device and patched all those affected.

Both of these vulnerabilities have already been patched on the affected devices. To be specific, CVE-2025-35451 (SSH or Telnet enabled by default) only affects specific firmware versions on the G2 cameras. The G3 cameras have never had SSH or Telnet enabled. CVE-2025-35452 (shared default password) has been patched on the G3 cameras along with the Q1 2025 Update. All G2 cameras are affected by this vulnerability.

Please see the tables below for a detailed report of the affected firmware and the remediations to fix the problem.

The PTZOptics team was alerted by VulnCheck, Inc. to three potential security vulnerabilities in the firmware of our G2 30x SDI/NDI camera as noted in Common Vulnerabilities and Exposures report CVE-2024-8956 and CVE-2024-8957. The identified vulnerabilities that, when used in combination with each other, could potentially allow unauthorized access to sensitive information and control over the cameras. The PTZOptics team tested this vulnerability against every PTZOptics device and we patched all those affected.

We have now enforced authentication across all API routes and web pages. To address the remote file write issue, users must provide administrative credentials to modify any configuration files on the camera. This ensures only authorized users can change the camera’s settings, safeguarding against unauthorized modifications to the underlying camera configuration files. Regarding the remote code execution issue, we have patched the relevant API and processes to prevent remote code execution. Since being alerted to these vulnerabilities, we have produced firmware updates that address these issues. To ensure the security of PTZOptics cameras, updating the firmware on G2 and G3 cameras is recommended. Detailed instructions for applying the updates are provided on our knowledge base and through our customer support channels.

Please refer to the table below to ensure the firmware for your specific product(s) is updated.