CVEvulnerability

CVE-2024-8957

7.2 HIGH Known exploited Published 2024-09-17 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability — PTZOptics PT30X-SDI/NDI Cameras

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

Added to KEV: 2024-11-04
Remediation due: 2024-11-25
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://ptzoptics.com/firmware-changelog/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-8957

Status: Analyzed
Published: 2024-09-17
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-78

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Affected configurations

• ptzoptics pt30x-sdi firmware (< 6.3.40) • ptzoptics pt30x-ndi-xx-g2 firmware (< 6.3.40)

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References