BaseFortify

Publication date: 2024-09-17

Last updated on: 2025-10-27

Assigner: VulnCheck

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2024-09-17

Last Modified

2025-10-27

Generated

2026-10-16

AI Q&A

2024-11-05

EPSS Evaluated

2026-10-14

NVD

CVE-2024-8956

Affected Vendors & Products

Vendor	Product	Version / Range
ptzoptics	pt30x-sdi_firmware	to 6.3.40 (exc)
ptzoptics	pt30x-sdi	*
ptzoptics	pt30x-ndi-xx-g2_firmware	to 6.3.40 (exc)
ptzoptics	pt30x-ndi-xx-g2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability, identified as CVE-2024-8956, affects certain PTZOptics cameras. It means that these cameras do not properly check if a user is allowed to access certain settings. Because of this, someone could potentially access sensitive information like usernames and passwords without needing to log in.

Impact Analysis

If you use a PTZOptics camera that is affected by this vulnerability, an attacker could gain access to your camera's sensitive information and settings. This could lead to unauthorized access to your camera, allowing the attacker to change settings or view private data.

Compliance Impact

This vulnerability could pose a risk to compliance with regulations like GDPR and HIPAA because it allows unauthorized access to sensitive data. If personal or health-related information is exposed due to this vulnerability, it could lead to violations of these regulations, resulting in potential legal and financial consequences.

Hi! I’m here to help you understand CVE-2024-8956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70