CVE-2024-8957 — PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value whic…
Published: 2024-09-17 · CVSS: 7.2 · CVSS 3.1
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7