返回 CVE 瀏覽器

CVE-2024-8957

🔥 Known Exploited (CISA KEV)HIGH

7.2

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-09-17

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Affected Platforms (CPE)

💻

Ptzoptics

Pt30x Sdi Firmware

< 6.3.40

💻

Ptzoptics

Pt30x Ndi Xx G2 Firmware

< 6.3.40

References & Advisories

🔗 https://ptzoptics.com/firmware-changelog/

🔗 https://vulncheck.com/advisories/ptzoptics-command-injection

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957

🔗 https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai

🔗 https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/

相關漏洞威脅

CVE-2026-658937.0

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with ...

CVE-2026-645208.4

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The ...

CVE-2026-645168.8

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCP...

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference Afte...