CVE-2024-8957 is an OS command injection vulnerability affecting PTZOptics PT30X-SDI/NDI-xx cameras running firmware older than 6.3.40. This flaw allows for arbitrary command execution due to insufficient validation of the ntp_addr configuration value, particularly when chained with CVE-2024-8956. Rated with a CVSS score of 7.2 (HIGH), this vulnerability can be exploited remotely by an unauthenticated attacker, leading to high impact on confidentiality, integrity, and availability. Its EPSS score and FAUCET Risk Score of 100/100 indicate a very high probability of exploitation. This CVE is actively exploited in the wild and has been added to CISA's KEV catalog. While no public Metasploit or ExploitDB modules exist, it has garnered significant community discussion and media coverage, including reports of its use by the Mirai botnet.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.3.40CPE matchmatch criteria | cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:* | ||
< 6.3.40CPE matchmatch criteria | cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.