← Voltar para CVEs

CVE-2024-8956

CRITICALCISA KEV

9.1

Descricao

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Detalhes CVE

Pontuacao CVSS v3.19.1

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado9/17/2024

Ultima modificacao10/27/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorPTZOptics

ProdutoPT30X-SDI/NDI Cameras

Nome da vulnerabilidadePTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Data inclusao KEV2024-11-04

Prazo de remediacao2024-11-25

Uso em ransomwareUnknown

Produtos afetados

ptzoptics:pt30x-ndi-xx-g2ptzoptics:pt30x-ndi-xx-g2_firmwareptzoptics:pt30x-sdiptzoptics:pt30x-sdi_firmware

Fraquezas (CWE)

CWE-306CWE-287

Referencias

https://ptzoptics.com/firmware-changelog/(disclosure@vulncheck.com)

https://vulncheck.com/advisories/ptzoptics-insufficient-auth(disclosure@vulncheck.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.