CVEvulnerability

CVE-2024-8956

9.1 CRITICAL Known exploited Published 2024-09-17 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability — PTZOptics PT30X-SDI/NDI Cameras

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

Added to KEV: 2024-11-04
Remediation due: 2024-11-25
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://ptzoptics.com/firmware-changelog/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-8956

Status: Analyzed
Published: 2024-09-17
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-287, CWE-306

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Affected configurations

• ptzoptics pt30x-sdi firmware (< 6.3.40) • ptzoptics pt30x-ndi-xx-g2 firmware (< 6.3.40)

Weakness · CWE (2)

CWE-287 Improper Authentication weakness
CWE-306 Missing Authentication for Critical Functionality weakness

References