PTZOptics Camera - Unauth RCE via NTP Config (CVE-2024-8957)

Chains CVE-2024-8956 missing auth on param.cgi with CVE-2024-8957 OS command injection in ntpaddr. Delivers a reverse CMD payload via POST /cgi-bin/param.cgi?postnetworkotherconf and waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics / VHD camera unauthenticated RCE...

PTZOptics Camera - Unauth System Config / Password Leak (CVE-2024-8956)

PTZOptics cameras expose /cgi-bin/param.cgi?getsystemconf without authentication, leaking userpasswd hashes CVE-2024-8956. Presence also indicates the related OS command injection CVE-2024-8957. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics camera insufficient auth leaking password hash...

PTZOptics Camera Detection (HTTP)

HTTP based detection of PTZOptics Camera devices. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-8957

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntpaddr configuration value which may lead to arbitrary command execution when ntpclient is started. When chained with CVE-2024-8956, a remote and...

CVE-2024-8956

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...

PTZOptics PT30X-SDI/NDI Authentication Bypass Code Execution

The vulnerability of the microprogrammed webcam software from PTZOptics PT30X-SDI/NDI is related to incorrect authentication. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted request without an HTTP CGI script authentication head...

PTZOptics Camera Web Interface Detection

Binary data ptzopticscamerawebdetect.nbin...

PTZOptics Camera Multiple Vulnerabilities (Direct Check)

Binary data ptzopticscameraCVE-2024-8956.nbin...

CVE-2024-8957

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntpaddr configuration value which may lead to arbitrary command execution when ntpclient is started. When chained with CVE-2024-8956, a remote and...

CVE-2024-8956

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...

CVE-2024-8956

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...

PTZOptics PT30X-SDI/NDI-xx security vulnerabilities

PTZOptics PT30X-SDI/NDI-xx is a series of HD cameras from PTZOptics. A security vulnerability exists in PTZOptics PT30X-SDI/NDI-xx versions prior to 6.3.40, which stems from insufficient validation of the ntpaddr configuration value. An attacker could use this vulnerability to execute arbitrary...

VulnCheck KEV: CVE-2024-8957

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntpaddr parameter of the /cgi-bin/param.cgi CGI script...