Actively exploited in the wild

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

PTZOptics - PT30X-SDI/NDI Cameras · Listed in the CISA KEV since 2024-11-04. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2024-8957

HighCVSS 7.2KEV

Published: 17/09/2024(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

OS command injection vulnerability in PTZOptics PT30X-SDI/NDI-xx cameras before firmware 6.3.40. The camera does not sufficiently validate the ntp_addr configuration value, which may lead to arbitrary command execution when ntp_client is started.

Risk Assessment

When chained with CVE-2024-8956, a remote unauthenticated attacker can execute arbitrary OS commands on affected devices, taking full control of the camera.

Recommendation

Update PTZOptics camera firmware to version 6.3.40 or later and isolate cameras in a dedicated VLAN without Internet access.

Other vulnerabilities in PTZOptics PT30X-SDI/NDI-xx

CVE-2024-8956CriticalActively exploited
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 has an insufficient authentication issue. The camera does not enforce authentication to /cgi-bin/param.cgi when requests lack an HTTP Authorization header. A remote unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configuration details, and can also update configuration values or overwrite the whole file.

Original NVD description (English source)

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.