← CVE Intelligence

CVE-2024-8957

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration PUBLISHED

Description (CNA)

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Affected (CNA)

Vendor / productVersions
PTZOptics / PT30X-SDIaffected 0 before 6.3.40
PTZOptics / PT30X-NDIaffected 0 before 6.3.40

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.