CVE-2024-8956

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Reserved 2024-09-17 | Published 2024-09-17 | Updated 2024-11-04 | Assigner VulnCheck

CISA Known Exploited Vulnerability

Date added 2024-11-04 | Due date 2024-11-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-287 Improper Authentication

Product status

Default status
unaffected

Any version before 6.3.40
affected

Default status
unaffected

Any version before 6.3.40
affected

Credits

Konstantin Lazarev of GreyNoise finder

References

ptzoptics.com/firmware-changelog/ vendor-advisory

vulncheck.com/advisories/ptzoptics-insufficient-auth third-party-advisory

cve.org (CVE-2024-8956)

nvd.nist.gov (CVE-2024-8956)

Download JSON