Nov 4, 2024

Updated

• Closed✓Patched

  PTZOptics PT30X-SDI/NDI Cameras: 2 actively exploited vulnerabilities

  CVE-2024-8956: PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root. CVE-2024-8957: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. Added to the CISA KEV catalog on 2024-11-04.

  PTZOptics PT30X-SDI/NDI Cameras·Closed Nov 4, 2024·updated Nov 4, 2024