VULNERABILITY INTELLIGENCE

CVE-2024-8956

CVSS score9.1 CRITICAL

EPSS probability58.79%

CISA KEVKnown exploited vulnerability

Published2024-09-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Known Exploited Vulnerability

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Vendor / product: PTZOptics / PT30X-SDI/NDI Cameras

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Weakness classification

disclosure@vulncheck.com: CWE-306
nvd@nist.gov: CWE-287

Primary references

disclosure@vulncheck.com — Release Notes
disclosure@vulncheck.com — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory