VULNERABILITY INTELLIGENCE

CVE-2024-8957

CVSS score7.2 HIGH

EPSS probability79.84%

CISA KEVKnown exploited vulnerability

Published2024-09-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

Vendor / product: PTZOptics / PT30X-SDI/NDI Cameras

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Weakness classification

disclosure@vulncheck.com: CWE-78
nvd@nist.gov: CWE-78

Primary references

disclosure@vulncheck.com — Release Notes
disclosure@vulncheck.com — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory