← CVE Radar
CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
7.2 HIGHEPSS 79.84%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.2 | HIGH | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Nov 25, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-8957
- Status
- Analyzed
- Assigner (CNA)
- VulnCheck
- Published
- Sep 17, 2024
- Last modified
- 2026-06-17 08:23 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
PTZOpticsPT30X-SDI1 version range
- before 6.3.40
PTZOpticsPT30X-NDI1 version range
- before 6.3.40
References
- ptzoptics.com https://ptzoptics.com/firmware-changelog/
- vulncheck.com https://vulncheck.com/advisories/ptzoptics-command-injection
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957
- greynoise.io https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
- labs.greynoise.io https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/