Read the docs
TI-2026-53185 Aliases CVE-2026-75969GHSA-2q27-rwqh-vgpm

PTZOptics Missing Authentication in Firmware Upload

Priority MEDIUM 47CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials. This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects: * Move 4K 12X before: 0.0.98 * Move 4K 20X before: 0.1.33 * Move 4K 30X before: 2.1.17 * Link 4K 12X before: 0.0.99 * Link 4K 20X before: 0.1.37 * Link 4K 30X before: 2.1.18 * Move SE 12X before: 9.1.66 * Move SE 20X before: 9.1.44 * Move SE 30X before: 9.1.46 * Studio 4K 12X before: 8.3.32 * Studio 4K 20X before: 8.3.32 * Studio SE 12X before: 8.3.32 * Studio SE 20X before: 8.3.32 * All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions * Upgrade Tool - All versions

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed Move 4K 12X (PTZOptics): 0.0.98Move 4K 20X (PTZOptics): 0.1.33+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PTZOpticsMove 4K 12Xbefore 0.0.980.0.98Patch availableCNA
PTZOpticsMove 4K 20Xbefore 0.1.330.1.33Patch availableCNA
PTZOpticsMove 4K 30Xbefore 2.1.172.1.17Patch availableCNA
PTZOpticsLink 4K 12Xbefore 0.0.990.0.99Patch availableCNA
PTZOpticsLink 4K 20Xbefore 0.1.370.1.37Patch availableCNA
PTZOpticsLink 4K 30Xbefore 2.1.182.1.18Patch availableCNA
PTZOpticsMove SE 12Xbefore 9.1.669.1.66Patch availableCNA
PTZOpticsMove SE 20Xbefore 9.1.449.1.44Patch availableCNA
PTZOpticsMove SE 30Xbefore 9.1.469.1.46Patch availableCNA
PTZOpticsStudio 4K 12Xbefore 8.3.328.3.32Patch availableCNA
PTZOpticsStudio 4K 20Xbefore 8.3.328.3.32Patch availableCNA
PTZOpticsStudio SE 12Xbefore 8.3.328.3.32Patch availableCNA
PTZOpticsStudio SE 20Xbefore 8.3.328.3.32Patch availableCNA
PTZOpticsPT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2all versions—No fix listedCNA
PTZOpticsPT12X-USB-GY-G2, PT12X-USB-WH-G2all versions—No fix listedCNA
PTZOpticsPT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2all versions—No fix listedCNA
PTZOpticsPT20X-USB-GY-G2, PT20X-USB-WH-G2all versions—No fix listedCNA
PTZOpticsPT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2all versions—No fix listedCNA
PTZOpticsPTVL-ZCAM, PTVL-NDI-ZCAMall versions—No fix listedCNA
PTZOpticsPTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2all versions—No fix listedCNA
PTZOpticsPT12X-ZCAM, PT12X-NDI-ZCAMall versions—No fix listedCNA
PTZOpticsPT20X-ZCAM, PT20X-NDI-ZCAMall versions—No fix listedCNA
PTZOpticsStudio Proall versions—No fix listedCNA
PTZOpticsUpgrade Toolall versions—No fix listedCNA
  • Move 4K 12X VendorPTZOptics Affected before 0.0.98 Fixed in 0.0.98 Patch available CNA
  • Move 4K 20X VendorPTZOptics Affected before 0.1.33 Fixed in 0.1.33 Patch available CNA
  • Move 4K 30X VendorPTZOptics Affected before 2.1.17 Fixed in 2.1.17 Patch available CNA
  • Link 4K 12X VendorPTZOptics Affected before 0.0.99 Fixed in 0.0.99 Patch available CNA
  • Link 4K 20X VendorPTZOptics Affected before 0.1.37 Fixed in 0.1.37 Patch available CNA
  • Link 4K 30X VendorPTZOptics Affected before 2.1.18 Fixed in 2.1.18 Patch available CNA
  • Move SE 12X VendorPTZOptics Affected before 9.1.66 Fixed in 9.1.66 Patch available CNA
  • Move SE 20X VendorPTZOptics Affected before 9.1.44 Fixed in 9.1.44 Patch available CNA
  • Move SE 30X VendorPTZOptics Affected before 9.1.46 Fixed in 9.1.46 Patch available CNA
  • Studio 4K 12X VendorPTZOptics Affected before 8.3.32 Fixed in 8.3.32 Patch available CNA
  • Studio 4K 20X VendorPTZOptics Affected before 8.3.32 Fixed in 8.3.32 Patch available CNA
  • Studio SE 12X VendorPTZOptics Affected before 8.3.32 Fixed in 8.3.32 Patch available CNA
  • Studio SE 20X VendorPTZOptics Affected before 8.3.32 Fixed in 8.3.32 Patch available CNA
  • PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT12X-USB-GY-G2, PT12X-USB-WH-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT20X-USB-GY-G2, PT20X-USB-WH-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PTVL-ZCAM, PTVL-NDI-ZCAM VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2 VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT12X-ZCAM, PT12X-NDI-ZCAM VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • PT20X-ZCAM, PT20X-NDI-ZCAM VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • Studio Pro VendorPTZOptics Affected all versions Fixed in — No fix listed CNA
  • Upgrade Tool VendorPTZOptics Affected all versions Fixed in — No fix listed CNA

Remediation

  • Fix · CNA Move 4K 12X (PTZOptics) Fixed in 0.0.98
  • Fix · CNA Move 4K 20X (PTZOptics) Fixed in 0.1.33
  • Fix · CNA Move 4K 30X (PTZOptics) Fixed in 2.1.17
  • Fix · CNA Link 4K 12X (PTZOptics) Fixed in 0.0.99
  • Fix · CNA Link 4K 20X (PTZOptics) Fixed in 0.1.37
  • Fix · CNA Link 4K 30X (PTZOptics) Fixed in 2.1.18
  • Fix · CNA Move SE 12X (PTZOptics) Fixed in 9.1.66
  • Fix · CNA Move SE 20X (PTZOptics) Fixed in 9.1.44
  • Fix · CNA Move SE 30X (PTZOptics) Fixed in 9.1.46
  • Fix · CNA Studio 4K 12X (PTZOptics) Fixed in 8.3.32
  • Fix · CNA Studio 4K 20X (PTZOptics) Fixed in 8.3.32
  • Fix · CNA Studio SE 12X (PTZOptics) Fixed in 8.3.32
  • Fix · CNA Studio SE 20X (PTZOptics) Fixed in 8.3.32

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75969
  2. 2026-10-03 Alias added: GHSA-2q27-rwqh-vgpm

References

Other 1

  • TI-2024-08316 PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication KEVCVSS 3.1CRITICAL 9.1
  • TI-2024-08317 PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration KEVCVSS 3.1HIGH 7.2
  • TI-2025-24592 Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled CVSS 4.0CRITICAL 9.3
  • TI-2025-24593 Pan-Tilt-Zoom cameras default administrative credentials for web interface CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences