CVE-2024-8957 PTZOptics PT30X-SDI/NDI Cameras OS Command Injection
Remote unauthenticated attackers can execute arbitrary OS commands on PTZOptics cameras via insufficient validation of the NTP address configuration.
- Exploited in the wild
- Since 4 Nov 2024
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8957?
CVE-2024-8957 is a high-severity command injection vulnerability in PTZOptics PT30X-NDI, published on 17 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Weakness: CWE-78
Which versions are affected by CVE-2024-8957?
It affects 2 products.
Products include Ptzoptics Pt30x-Ndi-Xx-G2 Firmware, Ptzoptics Pt30x-Sdi Firmware.
How do I fix CVE-2024-8957?
No fix has been published for CVE-2024-8957 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Nov 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-8957 being exploited?
Yes. Attackers have exploited CVE-2024-8957 in the wild since at least 4 Nov 2024.
Other vulnerabilities in PTZOptics PT30X-NDI
Sources
Also known as GHSA-9cx9-7v8g-h36v.