CVE-2024-8957 - CVE House
Back to Database
Status published High CVE-2024-8957

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

Vulnerability Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8957

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Konstantin Lazarev of GreyNoise

References

More from PTZOptics

View All →
CVE-2025-35452
Pan-Tilt-Zoom cameras default administrative credentials for web interface
Critical 9.2
CVE-2025-35451
Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
Critical 9.3
CVE-2024-8956
PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
Critical 9.1

Affected Vendor

Affected Software

PT30X-SDI, PT30X-NDI
Vulnerable Versions:
0

Timeline

Official Publish: September 17th, 2024
Last Modified: December 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration