Studio Se 12X
Monthly
Unauthenticated firmware replacement on PTZOptics PTZ cameras and the vendor's Firmware Upgrade Tool lets anyone who can reach the device's update endpoint flash a modified firmware image onto the hardware, handing the attacker persistent control of the camera without ever supplying administrator credentials. Rated CVSS 9.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with full confidentiality, integrity and availability impact), the missing-authentication flaw (CWE-306) covers the Move/Link/Studio 4K and SE families below their respective fix builds, every Generation-2 camera (PT12X/PT20X/PT30X SDI/NDI/USB, ZCAM variants, Studio Pro) at all versions, and all versions of the Upgrade Tool. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing) at time of analysis, but because exploitation is unauthenticated and needs no user interaction the only real gating factor is network reachability - these cameras normally sit on AV/production VLANs rather than the public internet, so an attacker must first gain a foothold on the same segment and then craft a firmware image the device accepts.
Unauthenticated firmware replacement on PTZOptics PTZ cameras and the vendor's Firmware Upgrade Tool lets anyone who can reach the device's update endpoint flash a modified firmware image onto the hardware, handing the attacker persistent control of the camera without ever supplying administrator credentials. Rated CVSS 9.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with full confidentiality, integrity and availability impact), the missing-authentication flaw (CWE-306) covers the Move/Link/Studio 4K and SE families below their respective fix builds, every Generation-2 camera (PT12X/PT20X/PT30X SDI/NDI/USB, ZCAM variants, Studio Pro) at all versions, and all versions of the Upgrade Tool. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing) at time of analysis, but because exploitation is unauthenticated and needs no user interaction the only real gating factor is network reachability - these cameras normally sit on AV/production VLANs rather than the public internet, so an attacker must first gain a foothold on the same segment and then craft a firmware image the device accepts.