CVE-2024-8957 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Reserved 2024-09-17 | Published 2024-09-17 | Updated 2024-11-04 | Assigner VulnCheck

HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Date added 2024-11-04 | Due date 2024-11-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Product status

Default status

unaffected

Any version before 6.3.40

affected

Default status

unaffected

Any version before 6.3.40

affected

Credits

Konstantin Lazarev of GreyNoise finder

References

ptzoptics.com/firmware-changelog/ vendor-advisory

vulncheck.com/advisories/ptzoptics-command-injection third-party-advisory

cve.org (CVE-2024-8957)

nvd.nist.gov (CVE-2024-8957)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-8957

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.