CVE-2024-8957: PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
Summary: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that lets a remote, authenticated attacker escalate privileges to root through a crafted payload in the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. CISA lists CVE-2024-8957 in its Known Exploited Vulnerabilities catalog with a remediation due date of 2024-11-25 and known ransomware campaign use marked Unknown.
Key Takeaway: An authenticated attacker who reaches the ntp_addr parameter can take root on a networked camera, and CISA's Unknown ransomware designation means the catalog entry gives no assurance either way about how this flaw is being used in extortion campaigns.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-8957PTZOptics
- Related
- CVE-2024-8956: PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Nov 04, 2024