← Zuruck zu CVEs

CVE-2024-8956

CRITICALCISA KEV

9.1

Beschreibung

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

CVE Details

CVSS v3.1 Bewertung9.1

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht9/17/2024

Zuletzt geandert10/27/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerPTZOptics

ProduktPT30X-SDI/NDI Cameras

SchwachstellennamePTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

KEV Aufnahmedatum2024-11-04

Behebungsfrist2024-11-25

Ransomware-NutzungUnknown

Betroffene Produkte

ptzoptics:pt30x-ndi-xx-g2ptzoptics:pt30x-ndi-xx-g2_firmwareptzoptics:pt30x-sdiptzoptics:pt30x-sdi_firmware

Schwachen (CWE)

CWE-306CWE-287

Referenzen

https://ptzoptics.com/firmware-changelog/(disclosure@vulncheck.com)

https://vulncheck.com/advisories/ptzoptics-insufficient-auth(disclosure@vulncheck.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.