PTZOptics · PT30X-SDI/NDI Cameras

CVE-2024-8957

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

Exploited in attacks High 7.2 Attack chance: 80%

What it is

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

CISA: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: November 25, 2024

ptzoptics.com/firmware-changelog/

Added to the CISA list: November 4, 2024
Published: September 17, 2024
Severity: High 7.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 80% in the top 0.4% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from PTZOptics

Added	Vulnerability	Product	Severity	Attack chance
Nov 4, 2024	Authentication BypassCVE-2024-8956	PT30X-SDI/NDI Cameras	Critical 9.1	59%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.