CVE-2024-8957
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
| Assigner | VulnCheck |
| Reserved | 2024-09-17 |
| Published | 2024-09-17 |
| Updated | 2024-11-04 |
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Konstantin Lazarev of GreyNoise
https://ptzoptics.com/firmware-changelog/
https://vulncheck.com/advisories/ptzoptics-command-injection
