All vulnerabilities
CVE-2024-8956

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

PTZOptics PT30X-SDI/NDI Cameras
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationExploited in the wildAdded to KEV 4 Nov 2024CISA KEV
Exploit odds (EPSS)58.8%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.3.40Fixed versionCVE List
Federal deadline25 Nov 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Sep 2024, 19:59 UTCPublishedCVE List
  2. 4 Nov 2024Added to CISA KEVCISA KEV

Description

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

Text from CVE List

Affected versions 2

  • PT30X-SDIaffected: all versions before 6.3.40CVE List
  • PT30X-NDIaffected: all versions before 6.3.40CVE List

References 6