PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 04/11/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| PT30X-SDI/NDI Cameras | Versions not published yet (product named by CISA KEV) | |
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free