CVE-2024-8956

CVE-2024-8956 is a critical-severity (CVSS 9.1) vulnerability in PTZOptics PT30X-SDI/NDI Cameras. CISA added it to the Known Exploited Vulnerabilities catalog on November 4, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 25, 2024. CISA does not currently list it as used in ransomware campaigns. PTZOptics has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• https://ptzoptics.com/firmware-changelog/
• https://vulncheck.com/advisories/ptzoptics-insufficient-auth
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956
• https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
• https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/