BaseFortify

Publication date: 2024-09-17

Last updated on: 2025-10-27

Assigner: VulnCheck

Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2024-09-17

Last Modified

2025-10-27

Generated

2026-10-16

AI Q&A

2024-11-05

EPSS Evaluated

2026-10-14

NVD

CVE-2024-8957

Affected Vendors & Products

Vendor	Product	Version / Range
ptzoptics	pt30x-sdi_firmware	to 6.3.40 (exc)
ptzoptics	pt30x-sdi	*
ptzoptics	pt30x-ndi-xx-g2_firmware	to 6.3.40 (exc)
ptzoptics	pt30x-ndi-xx-g2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2024-8957 is a security issue found in certain PTZOptics cameras. It allows an attacker to run unauthorized commands on the camera because the device does not properly check a specific setting. This can happen when the camera's time synchronization feature is activated. If this vulnerability is combined with another related issue, an attacker can take control of the camera remotely without needing any special access.

Impact Analysis

If you use a PTZOptics camera that is affected by this vulnerability, an attacker could potentially take control of the camera and execute commands that could compromise your privacy or security. This could lead to unauthorized access to video feeds or manipulation of the camera's settings.

Compliance Impact

This vulnerability could pose a risk to compliance with regulations like GDPR and HIPAA, which require organizations to protect personal and sensitive data. If an attacker gains access to the camera and its data, it could lead to unauthorized exposure of personal information, potentially resulting in legal consequences and fines for failing to protect that data.

Hi! I’m here to help you understand CVE-2024-8957. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70