Description
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PTZOptics PT30X-SDI
Default version status: unaffected
0 to < 6.3.40affected
PTZOptics PT30X-NDI
Default version status: unaffected
0 to < 6.3.40affected
References
- https://ptzoptics.com/firmware-changelog/ ↗
- https://vulncheck.com/advisories/ptzoptics-command-injection ↗
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ ↗
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957 ↗