All vulnerabilities
CVE-2024-8957

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

PTZOptics PT30X-SDI/NDI Cameras
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationExploited in the wildAdded to KEV 4 Nov 2024CISA KEV
Exploit odds (EPSS)79.8%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.3.40Fixed versionCVE List
Federal deadline25 Nov 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Sep 2024, 20:08 UTCPublishedCVE List
  2. 4 Nov 2024Added to CISA KEVCISA KEV

Description

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

Text from CVE List

Affected versions 2

  • PT30X-SDIaffected: all versions before 6.3.40CVE List
  • PT30X-NDIaffected: all versions before 6.3.40CVE List

References 6