Riskcovery

CVE-2026-75969

PTZOptics Missing Authentication in Firmware Upload

State
Published
Severity
9.1 Critical
Published
Sep 30, 2026
Updated
Sep 30, 2026
Reserved
Aug 18, 2026

Read the record on cve.org

Description

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.

This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:

* Move 4K 12X before: 0.0.98 * Move 4K 20X before: 0.1.33 * Move 4K 30X before: 2.1.17 * Link 4K 12X before: 0.0.99 * Link 4K 20X before: 0.1.37 * Link 4K 30X before: 2.1.18 * Move SE 12X before: 9.1.66 * Move SE 20X before: 9.1.44 * Move SE 30X before: 9.1.46 * Studio 4K 12X before: 8.3.32 * Studio 4K 20X before: 8.3.32 * Studio SE 12X before: 8.3.32 * Studio SE 20X before: 8.3.32 * All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions * Upgrade Tool - All versions

Scores

CVSSScoreVectorSource
4.09.1 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Redhsi

Weaknesses

  • CWE-306 Missing authentication for critical function

Affected Products

ProductVersions
Move 4K 12XPTZOptics
  • before 0.0.98Affected
Move 4K 20XPTZOptics
  • before 0.1.33Affected
Move 4K 30XPTZOptics
  • before 2.1.17Affected
Link 4K 12XPTZOptics
  • before 0.0.99Affected
Link 4K 20XPTZOptics
  • before 0.1.37Affected
Link 4K 30XPTZOptics
  • before 2.1.18Affected
Move SE 12XPTZOptics
  • before 9.1.66Affected
Move SE 20XPTZOptics
  • before 9.1.44Affected
Move SE 30XPTZOptics
  • before 9.1.46Affected
Studio 4K 12XPTZOptics
  • before 8.3.32Affected
Studio 4K 20XPTZOptics
  • before 8.3.32Affected
Studio SE 12XPTZOptics
  • before 8.3.32Affected
Studio SE 20XPTZOptics
  • before 8.3.32Affected
PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2PTZOptics
  • 0Affected
PT12X-USB-GY-G2, PT12X-USB-WH-G2PTZOptics
  • 0Affected
PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2PTZOptics
  • 0Affected
PT20X-USB-GY-G2, PT20X-USB-WH-G2PTZOptics
  • 0Affected
PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2PTZOptics
  • 0Affected
PTVL-ZCAM, PTVL-NDI-ZCAMPTZOptics
  • 0Affected
PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2PTZOptics
  • 0Affected
PT12X-ZCAM, PT12X-NDI-ZCAMPTZOptics
  • 0Affected
PT20X-ZCAM, PT20X-NDI-ZCAMPTZOptics
  • 0Affected
Studio ProPTZOptics
  • 0Affected
Upgrade ToolPTZOptics
  • 0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.