CVE-2024-8957
PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
Description
CVE-2024-8957 is a high-severity OS command injection vulnerability in PTZOptics PT30X-SDI/NDI cameras before firmware version 6.3.40, scoring 7.2 on the CVSS v3.1 scale. The vulnerability exists in the NTP client configuration where the ntp_addr parameter is insufficiently validated, allowing an authenticated attacker to inject and execute arbitrary operating system commands. When chained with CVE-2024-8956 (authentication bypass), this vulnerability enables completely unauthenticated remote code execution. CISA has added this to the KEV catalog with a remediation deadline of November 25, 2024, and it carries an EPSS score of 0.55516 (98.0th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ptzoptics | pt30x-sdi firmware | < 6.3.40 |
| ptzoptics | pt30x-ndi-xx-g2 firmware | < 6.3.40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://ptzoptics.com/firmware-changelog/(Release Notes)
- https://vulncheck.com/advisories/ptzoptics-command-injection(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957(US Government Resource)
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai(Third Party Advisory)
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/(Exploit, Third Party Advisory)
Weakness Type
The specific CWE classifications for CVE-2024-8957 have not been formally assigned. The vulnerability is functionally an OS command injection weakness. The camera's NTP client configuration handler accepts a server address (ntp_addr) from user input and incorporates it into a system command that starts the NTP client process. The input validation on this parameter is insufficient, failing to properly sanitize or reject shell metacharacters and command separators. An attacker who can set the ntp_addr value can inject arbitrary OS commands that execute with the privileges of the camera's operating system process, typically running as root on embedded Linux devices.
Impact Analysis
The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that CVE-2024-8957 requires high privileges (administrator access) when exploited in isolation, but delivers maximum impact across confidentiality, integrity, and availability. However, the practical impact is dramatically amplified when combined with CVE-2024-8956, which provides unauthenticated admin access. Confidentiality impact (High) allows the attacker to access any data on the camera, including video feeds, stored recordings, network credentials, and configuration secrets. Integrity impact (High) enables modification of any system file, installation of persistent backdoors, and manipulation of video feeds. Availability impact (High) allows the attacker to disable the camera, disrupt video streaming, or brick the device. Business consequences include unauthorized surveillance, video feed manipulation or interception, use of compromised cameras as network pivot points, and potential inclusion in IoT botnets. The EPSS score of 0.55516 (98.0th percentile) reflects high exploitation probability, particularly given the publicly available exploit chain documentation.
Exploit Maturity
CVE-2024-8957 was discovered alongside CVE-2024-8956 as a zero-day vulnerability by GreyNoise Intelligence, with a detailed technical analysis published that demonstrates the full exploitation chain. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 25, 2024. The ransomware association is classified as "Unknown." The EPSS score of 0.55516 (98.0th percentile) confirms high exploitation probability. GreyNoise's research blog details how the vulnerability was discovered using AI-assisted threat detection. While the vulnerability nominally requires admin-level authentication, the chain with CVE-2024-8956 eliminates this barrier, making the combined exploit fully unauthenticated. The availability of detailed exploit documentation and the simplicity of the command injection make this accessible to attackers with minimal sophistication.
Remediation
- Update firmware to version 6.3.40 or later — Apply the latest firmware from the PTZOptics firmware changelog for all PT30X-SDI and PT30X-NDI camera models to address both this command injection and the related authentication bypass (CVE-2024-8956).
- Network-isolate all camera devices — Deploy cameras on a dedicated VLAN with strict firewall rules preventing direct internet access and limiting management access to authorized IP addresses only. This mitigates both the direct and chained exploitation paths.
- Verify device integrity after patching — Since the vulnerability allows arbitrary command execution, compromised cameras may have persistent backdoors installed. After updating firmware, perform a factory reset to ensure any attacker-installed modifications are removed, then reconfigure from a known-good baseline.
- Monitor for indicators of compromise — Check camera devices for unexpected outbound network connections, modified configuration files, unauthorized user accounts, and unusual NTP server settings. Examine network traffic logs for any communications with suspicious external addresses from camera IP ranges.
- Implement network segmentation for IoT devices — Establish a broader security policy that places all IoT and embedded devices on isolated network segments with monitoring, preventing compromised devices from being used to attack other parts of the infrastructure.
Technical Details
The CVSS v3.1 vector for CVE-2024-8957 is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 7.2 (High). Attack Vector (Network) confirms remote exploitation. Attack Complexity (Low) means the injection is reliable and straightforward. Privileges Required (High) indicates administrator-level access is nominally required, though this is trivially obtained via CVE-2024-8956. User Interaction (None) confirms no victim action is needed. Scope (Unchanged) keeps the impact within the camera's security context. Confidentiality, Integrity, and Availability (all High) reflect complete device compromise through arbitrary command execution. The attack mechanism targets the NTP client configuration functionality. When an administrator sets the NTP server address through the camera's CGI interface, the ntp_addr value is incorporated into a command string that launches the ntp_client process. Because the input is not properly sanitized for shell metacharacters such as semicolons, backticks, or pipe characters, an attacker can append arbitrary commands to the NTP address field. When the NTP client is subsequently started, the injected commands execute with the camera's system-level privileges, typically root on embedded Linux. Combined with CVE-2024-8956, the full attack chain is: send an unauthenticated request to /cgi-bin/param.cgi to set a malicious ntp_addr value, then trigger the NTP client start to execute the injected commands.
Frequently Asked Questions
What is CVE-2024-8957?
CVE-2024-8957 is an OS command injection vulnerability in PTZOptics PT30X-SDI/NDI cameras that allows an attacker to execute arbitrary system commands by injecting malicious input into the NTP server address configuration. While it nominally requires admin access, it is typically chained with CVE-2024-8956 for unauthenticated exploitation.
How does CVE-2024-8957 relate to CVE-2024-8956?
CVE-2024-8956 provides unauthenticated access to the camera's configuration interface, eliminating the authentication requirement for CVE-2024-8957. Together, they form a complete unauthenticated remote code execution chain — the authentication bypass grants admin access, and the command injection enables arbitrary command execution.
What can an attacker do with CVE-2024-8957?
An attacker can execute arbitrary operating system commands on the camera with root-level privileges. This enables full device takeover, including accessing video feeds, installing persistent backdoors, using the camera as a network pivot point, or adding it to an IoT botnet.
How do I fix CVE-2024-8957?
Update your PTZOptics camera firmware to version 6.3.40 or later, which addresses both this vulnerability and CVE-2024-8956. After updating, perform a factory reset to remove any potential backdoors, then isolate cameras on a dedicated network segment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.