CVE-2024-8957
HighActively exploited (CISA KEV)
Description
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
SeverityHigh
CVSS7.2
Exploit probability—
ProductPTZOptics PT30X-SDI/NDI Cameras
PublishedSep 17, 2024
First seenSep 17, 2024
Added to KEVNov 4, 2024
Weakness typeCWE-78OS command injection
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Nov 25, 2024Update
- ptzoptics pt30x-sdi_firmware6.3.40 or later
- ptzoptics pt30x-ndi-xx-g2_firmware6.3.40 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ptzoptics pt30x-sdi_firmware | v < 6.3.40 | 6.3.40 |
| ptzoptics pt30x-ndi-xx-g2_firmware | v < 6.3.40 | 6.3.40 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.