Actively exploited · Published Sep 17, 2024 · Assigned by VulnCheck
CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
High 7.2 Exploited
In plain English
A high-severity OS command injection in PT30X-NDI from PTZOptics. Attackers are actively exploiting it in the wild (listed by CISA on November 4, 2024). The chance it is exploited in the next 30 days is estimated at 79.8% (higher than 99.6% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 25, 2024.
Official description
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://ptzoptics.com/firmware-changelog/ vendor-advisory
- https://vulncheck.com/advisories/ptzoptics-command-injection third-party-advisory
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ exploit, technical-description, third-party-advisory
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957 government-resource