CVE-2024-8957highunder attackCWE-78

CVE-2024-8957: high-severity vulnerability in PTZOptics PT30X-SDI

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

Published · Updated

Follow this CVE+ Monitor PT30X-NDI+ Monitor PT30X-SDI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.2epss 80%
from disclosure to weapon
Published on NVDSep 17
CISA KEV+48d
Action required by CISAfederal deadline: 2024-11-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

PTZOptics cameras fail to properly check the NTP server address setting, allowing attackers to sneak malicious commands into it. When the camera starts its time synchronization service, these commands run with system privileges, giving attackers complete control of the device.

Technical detail

OS command injection vulnerability in PTZOptics PT30X-SDI/NDI-xx cameras (firmware < 6.3.40) due to insufficient input validation of the ntp_addr configuration parameter. The vulnerability is triggered when ntp_client service starts, allowing arbitrary command execution. When combined with CVE-2024-8956, remote unauthenticated attackers can achieve full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
PTZOptics · PT30X-NDIPTZOptics · PT30X-SDI
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PTZOptics PT30X-SDI

In the same product, most dangerous first.

CVE-2024-8956CRITICALPTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient AuthenticationEPSS 58.8%KEV