CVE-2024-8956
PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability
Description
CVE-2024-8956 is a critical insufficient authentication vulnerability in PTZOptics PT30X-SDI/NDI cameras before firmware version 6.3.40 that allows unauthenticated remote access to sensitive configuration data. Rated 9.1 on the CVSS v3.1 scale, the vulnerability exists in the /cgi-bin/param.cgi endpoint, which fails to enforce authentication when HTTP requests are sent without an Authorization header. An attacker can leak usernames, password hashes, and device configurations. Listed in CISA's KEV catalog with a remediation deadline of November 25, 2024, this vulnerability carries an EPSS score of 0.83611 (99.3rd percentile) and was discovered as a zero-day with the assistance of AI-based threat detection.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ptzoptics | pt30x-sdi firmware | < 6.3.40 |
| ptzoptics | pt30x-ndi-xx-g2 firmware | < 6.3.40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://ptzoptics.com/firmware-changelog/(Release Notes)
- https://vulncheck.com/advisories/ptzoptics-insufficient-auth(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956(US Government Resource)
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai(Third Party Advisory)
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/(Exploit, Third Party Advisory)
Weakness Type
The specific CWE classifications for CVE-2024-8956 have not been formally assigned. The vulnerability is functionally an insufficient authentication weakness where the camera's CGI interface fails to validate that incoming requests include proper authentication credentials. Specifically, the /cgi-bin/param.cgi endpoint processes requests that lack an HTTP Authorization header without rejecting them, granting unauthenticated access to sensitive device parameters. This is a fundamental authentication design flaw rather than a bypass of an existing mechanism — the camera simply does not check for credentials when the Authorization header is absent, rather than having a check that can be circumvented.
Impact Analysis
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms that CVE-2024-8956 delivers high impact on both confidentiality and integrity without requiring any authentication, user interaction, or special conditions. Confidentiality impact (High) allows the attacker to extract usernames, password hashes, network configurations, streaming parameters, and other sensitive device data that can be used for further attacks. Integrity impact (High) means the attacker can modify device configurations, potentially redirecting video streams, changing network settings, or altering camera behavior. Availability is not directly affected. Business consequences are significant for organizations using these cameras for security surveillance, live streaming, or video conferencing. Compromised cameras can be used for unauthorized surveillance, video stream interception, and as pivot points into internal networks. When chained with CVE-2024-8957 (OS command injection), the authentication bypass becomes an entry point for full device takeover and remote code execution. The EPSS score of 0.83611 (99.3rd percentile) reflects the high exploitation probability driven by the trivial attack requirements and internet-exposed camera installations.
Exploit Maturity
CVE-2024-8956 was discovered as a zero-day vulnerability by GreyNoise Intelligence using AI-assisted threat detection, as detailed in their research blog. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 25, 2024. The ransomware association is classified as "Unknown." The EPSS score of 0.83611 (99.3rd percentile) indicates very high exploitation probability. A detailed technical writeup with exploit details is publicly available, demonstrating both the authentication bypass and the chain with CVE-2024-8957 for full RCE. The vulnerability is particularly dangerous because PTZOptics cameras are often deployed in internet-accessible configurations for live streaming and remote monitoring, providing a large attack surface for automated scanning and exploitation.
Remediation
- Update firmware to version 6.3.40 or later — Download and apply the latest firmware from the PTZOptics firmware changelog for all PT30X-SDI and PT30X-NDI camera models in your environment.
- Isolate cameras on a dedicated network segment — Place all PTZOptics cameras on a separate VLAN or network segment that is not directly accessible from the internet or general corporate network. Use a firewall to restrict access to authorized management stations only.
- Change all camera credentials immediately — Since the vulnerability exposes usernames and password hashes, rotate all camera authentication credentials after applying the firmware update. Use strong, unique passwords for each device.
- Audit camera configurations for tampering — Review all camera settings including network configuration, streaming endpoints, NTP settings, and user accounts. Compare against known-good configurations to detect any unauthorized modifications that may have occurred during the exposure window.
- Monitor network traffic from cameras — Implement network monitoring to detect unusual traffic patterns from camera devices, such as connections to unexpected external IP addresses, large data transfers, or command-and-control communications that could indicate compromise.
Technical Details
The CVSS v3.1 vector for CVE-2024-8956 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, resulting in a base score of 9.1 (Critical). Attack Vector (Network) confirms remote exploitation over HTTP. Attack Complexity (Low) means the attack requires only a simple HTTP request. Privileges Required (None) and User Interaction (None) confirm fully unauthenticated, automated exploitation. Scope (Unchanged) keeps the direct impact within the camera's security context. Confidentiality (High) and Integrity (High) reflect the ability to read and modify all device configurations. Availability (None) indicates the vulnerability itself does not cause service disruption, though combined with CVE-2024-8957, full device takeover including denial of service becomes possible. The attack mechanism is straightforward: the /cgi-bin/param.cgi endpoint on PTZOptics cameras processes CGI requests to read and write device parameters. When a request arrives without an HTTP Authorization header, the authentication check is effectively skipped, and the request is processed as if it came from an authenticated administrator. This allows an attacker to enumerate all device parameters, extract stored credentials (including password hashes), and modify any configuration setting on the camera.
Frequently Asked Questions
What is CVE-2024-8956?
CVE-2024-8956 is a critical authentication bypass vulnerability in PTZOptics PT30X-SDI/NDI cameras that allows unauthenticated remote attackers to access and modify camera configurations, including extracting usernames and password hashes. It affects firmware versions before 6.3.40.
How was CVE-2024-8956 discovered?
This vulnerability was discovered as a zero-day by GreyNoise Intelligence using AI-assisted threat detection. GreyNoise's analysis identified suspicious traffic patterns targeting PTZOptics cameras, leading to the identification of both this authentication bypass and the related command injection vulnerability CVE-2024-8957.
Can CVE-2024-8956 lead to full device takeover?
Yes, when chained with CVE-2024-8957 (OS command injection in the NTP configuration), the authentication bypass provided by CVE-2024-8956 enables a completely unauthenticated attacker to achieve remote code execution on the camera. This combination allows full device takeover.
How do I fix CVE-2024-8956?
Update your PTZOptics camera firmware to version 6.3.40 or later. After updating, change all camera credentials and place cameras on an isolated network segment that is not directly accessible from the internet.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.