---
id: CVE-2026-75969
title: >-
  Missing authentication for critical function vulnerability for all PTZOptics
  cameras and the Firmware Upgrade Tool - Firmware Update modules
summary: >-
  Missing authentication for critical function vulnerability for all PTZOptics
  cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing
  authentication vulnerability in the firmware update mechanism of affected
  PTZOptics c…
severity: critical
cvss: 9.1
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/R:U/V:C/RE:L/U:Red
cwe:
  - CWE-306
vendor: PTZOptics
product: Move 4K 12X
affected:
  - move_4k_12x < 0.0.98
  - move_4k_20x < 0.1.33
  - move_4k_30x < 2.1.17
  - link_4k_12x < 0.0.99
  - link_4k_20x < 0.1.37
  - link_4k_30x < 2.1.18
  - move_se_12x < 9.1.66
  - move_se_20x < 9.1.44
  - move_se_30x < 9.1.46
  - studio_4k_12x < 8.3.32
  - studio_4k_20x < 8.3.32
  - studio_se_12x < 8.3.32
  - studio_se_20x < 8.3.32
  - pt12x-sdi-gy-g2_pt12x-sdi-wh-g2_pt12x-ndi-gy-g2_pt12x-ndi-wh-g2 all versions
  - pt12x-usb-gy-g2_pt12x-usb-wh-g2 all versions
  - pt20x-sdi-gy-g2_pt20x-sdi-wh-g2_pt20x-ndi-gy-g2_pt20x-ndi-wh-g2 all versions
  - pt20x-usb-gy-g2_pt20x-usb-wh-g2 all versions
  - pt30x-sdi-gy-g2_pt30x-sdi-wh-g2_pt30x-ndi-gy-g2_pt30x-ndi-wh-g2 all versions
  - ptvl-zcam_ptvl-ndi-zcam all versions
  - pteptz-zcam-g2_pteptz-ndi-zcam-g2 all versions
  - pt12x-zcam_pt12x-ndi-zcam all versions
  - pt20x-zcam_pt20x-ndi-zcam all versions
  - studio_pro all versions
  - upgrade_tool all versions
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T21:17:13.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75969'
references:
  - url: 'https://psirt.havsys.com/'
    label: 16cac6a8-cc1e-4741-89aa-6b97e2437706
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-30T18:30:11.739848Z'
cvssSource: cna
ingestedAt: '2026-09-30T17:13:20.839Z'
---

## Overview

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.



This vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:





  *  Move 4K 12X before: 0.0.98
  *  Move 4K 20X before: 0.1.33
  *  Move 4K 30X before: 2.1.17
  *  Link 4K 12X before: 0.0.99
  *  Link 4K 20X before: 0.1.37
  *  Link 4K 30X before: 2.1.18
  *  Move SE 12X before: 9.1.66
  *  Move SE 20X before: 9.1.44
  *  Move SE 30X before: 9.1.46
  *  Studio 4K 12X before: 8.3.32
  *  Studio 4K 20X before: 8.3.32
  *  Studio SE 12X before: 8.3.32
  *  Studio SE 20X before: 8.3.32
  *  All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions
  *  Upgrade Tool - All versions

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.