PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
References
| Link | Resource |
|---|---|
| https://ptzoptics.com/firmware-changelog/ | Release Notes |
| https://vulncheck.com/advisories/ptzoptics-command-injection | Third Party Advisory |
| https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai | Third Party Advisory |
| https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ | Exploit Third Party Advisory |
Configurations
History
09 Sep 2025, 14:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai - Third Party Advisory | |
| References | () https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ - Exploit, Third Party Advisory |
08 Sep 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-09-17 21:15
Updated : 2025-09-09 14:11
NVD link : CVE-2024-8957
Mitre link : CVE-2024-8957
CVE.ORG link : CVE-2024-8957
JSON object : View
Products Affected
ptzoptics
- pt30x-sdi
- pt30x-ndi-xx-g2
- pt30x-sdi_firmware
- pt30x-ndi-xx-g2_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')