CVE-2026-75969
PTZOptics Missing Authentication in Firmware Upload
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
- Move 4K 12X before: 0.0.98
- Move 4K 20X before: 0.1.33
- Move 4K 30X before: 2.1.17
- Link 4K 12X before: 0.0.99
- Link 4K 20X before: 0.1.37
- Link 4K 30X before: 2.1.18
- Move SE 12X before: 9.1.66
- Move SE 20X before: 9.1.44
- Move SE 30X before: 9.1.46
- Studio 4K 12X before: 8.3.32
- Studio 4K 20X before: 8.3.32
- Studio SE 12X before: 8.3.32
- Studio SE 20X before: 8.3.32
- All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
- Upgrade Tool - All versions
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
PTZOptics Missing Authentication in Firmware Upload
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
- Move 4K 12X before: 0.0.98
- Move 4K 20X before: 0.1.33
- Move 4K 30X before: 2.1.17
- Link 4K 12X before: 0.0.99
- Link 4K 20X before: 0.1.37
- Link 4K 30X before: 2.1.18
- Move SE 12X before: 9.1.66
- Move SE 20X before: 9.1.44
- Move SE 30X before: 9.1.46
- Studio 4K 12X before: 8.3.32
- Studio 4K 20X before: 8.3.32
- Studio SE 12X before: 8.3.32
- Studio SE 20X before: 8.3.32
- All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
- Upgrade Tool - All versions
- Record
CVE-2026-75969- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2026-90084
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
- Move 4K 12X before: 0.0.98
- Move 4K 20X before: 0.1.33
- Move 4K 30X before: 2.1.17
- Link 4K 12X before: 0.0.99
- Link 4K 20X before: 0.1.37
- Link 4K 30X before: 2.1.18
- Move SE 12X before: 9.1.66
- Move SE 20X before: 9.1.44
- Move SE 30X before: 9.1.46
- Studio 4K 12X before: 8.3.32
- Studio 4K 20X before: 8.3.32
- Studio SE 12X before: 8.3.32
- Studio SE 20X before: 8.3.32
- All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
- Upgrade Tool - All versions
- Record
EUVD-2026-90084- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2q27-rwqh-vgpm
Missing authentication for critical function vulnerability for all PTZOptics cameras and the...
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
- Move 4K 12X before: 0.0.98
- Move 4K 20X before: 0.1.33
- Move 4K 30X before: 2.1.17
- Link 4K 12X before: 0.0.99
- Link 4K 20X before: 0.1.37
- Link 4K 30X before: 2.1.18
- Move SE 12X before: 9.1.66
- Move SE 20X before: 9.1.44
- Move SE 30X before: 9.1.46
- Studio 4K 12X before: 8.3.32
- Studio 4K 20X before: 8.3.32
- Studio SE 12X before: 8.3.32
- Studio SE 20X before: 8.3.32
- All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
- Upgrade Tool - All versions
- Record
GHSA-2q27-rwqh-vgpm- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:L/U:Red - Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.
This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:
- Move 4K 12X before: 0.0.98
- Move 4K 20X before: 0.1.33
- Move 4K 30X before: 2.1.17
- Link 4K 12X before: 0.0.99
- Link 4K 20X before: 0.1.37
- Link 4K 30X before: 2.1.18
- Move SE 12X before: 9.1.66
- Move SE 20X before: 9.1.44
- Move SE 30X before: 9.1.46
- Studio 4K 12X before: 8.3.32
- Studio 4K 20X before: 8.3.32
- Studio SE 12X before: 8.3.32
- Studio SE 20X before: 8.3.32
- All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
- Upgrade Tool - All versions
- Record
CVE-2026-75969- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:L/U:Red - Weakness
- CWE-306
- Updated
- 2026-11-02
Affected products
- ptzoptics link 4k 12x
- ptzoptics link 4k 20x
- ptzoptics link 4k 30x
- ptzoptics move 4k 12x
- ptzoptics move 4k 20x
- ptzoptics move 4k 30x
- ptzoptics move se 12x
- ptzoptics move se 20x
- ptzoptics move se 30x
- ptzoptics pt12x-sdi-gy-g2, pt12x-sdi-wh-g2, pt12x-ndi-gy-g2, pt12x-ndi-wh-g2
- ptzoptics pt12x-usb-gy-g2, pt12x-usb-wh-g2
- ptzoptics pt12x-zcam, pt12x-ndi-zcam
Show 12 moreShow less
- ptzoptics pt20x-sdi-gy-g2, pt20x-sdi-wh-g2, pt20x-ndi-gy-g2, pt20x-ndi-wh-g2
- ptzoptics pt20x-usb-gy-g2, pt20x-usb-wh-g2
- ptzoptics pt20x-zcam, pt20x-ndi-zcam
- ptzoptics pt30x-sdi-gy-g2, pt30x-sdi-wh-g2, pt30x-ndi-gy-g2, pt30x-ndi-wh-g2
- ptzoptics pteptz-zcam-g2, pteptz-ndi-zcam-g2
- ptzoptics ptvl-zcam, ptvl-ndi-zcam
- ptzoptics studio 4k 12x
- ptzoptics studio 4k 20x
- ptzoptics studio pro
- ptzoptics studio se 12x
- ptzoptics studio se 20x
- ptzoptics upgrade tool
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75969 is a critical vulnerability (CVSS 9.1) in Ptzoptics Link 4k 12x, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.