PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
References
| Link | Resource |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | Release Notes |
| https://vulncheck.com/advisories/ptzoptics-insufficient-auth | Third Party Advisory |
| https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai | Third Party Advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ | Exploit Third Party Advisory |
Configurations
History
25 Sep 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 |
09 Sep 2025, 14:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai - Third Party Advisory | |
| References | () https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ - Exploit, Third Party Advisory |
08 Sep 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-09-17 20:15
Updated : 2025-09-26 14:06
NVD link : CVE-2024-8956
Mitre link : CVE-2024-8956
CVE.ORG link : CVE-2024-8956
JSON object : View
Products Affected
ptzoptics
- pt30x-sdi
- pt30x-ndi-xx-g2
- pt30x-sdi_firmware
- pt30x-ndi-xx-g2_firmware