CVE-2024-8956criticalunder attackCWE-306

CVE-2024-8956: critical vulnerability in PTZOptics PT30X-SDI

PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication

Published · Updated

Follow this CVE+ Monitor PT30X-NDI+ Monitor PT30X-SDI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.1epss 59%
from disclosure to weapon
Published on NVDSep 17
CISA KEV+48d
Action required by CISAfederal deadline: 2024-11-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

PTZOptics cameras allow anyone to access and modify camera settings without logging in by sending requests to a specific web address. An attacker can steal passwords, usernames, and camera configurations, or change settings remotely without permission.

Technical detail

The /cgi-bin/param.cgi endpoint in PTZOptics PT30X-SDI/NDI cameras fails to validate HTTP Authorization headers, allowing unauthenticated remote access. Attackers can retrieve sensitive data including credential hashes and configuration parameters, or perform unauthorized modifications to camera settings via parameter manipulation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
PTZOptics · PT30X-NDIPTZOptics · PT30X-SDI
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PTZOptics PT30X-SDI

In the same product, most dangerous first.

CVE-2024-8957HIGHPTZOptics NDI and SDI Cameras Command Injection via NTP Address ConfigurationEPSS 79.8%KEV