CVE-2024-8957

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

7.2 HighIn KEV

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

79.8%Up 79.8 points since Sep 18, 2024

What each source reports

CVE List Score used 7.2

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

Record: CVE-2024-8957
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2024-49506 7.2

Record: EUVD-2024-49506
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9cx9-7v8g-h36v 7.2

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue....

Record: GHSA-9cx9-7v8g-h36v
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

CISA KEV No score

PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

Record: CVE-2024-8957
Weakness: CWE-78
Updated: 2026-11-02

NVD 7.2

Record: CVE-2024-8957
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-8957 is a high vulnerability (CVSS 7.2) in Ptzoptics Pt30x-sdi, published September 17, 2024. CISA lists it as known to be exploited, since November 4, 2024. EUVD reports exploitation since November 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 79.8%, the 99th percentile. No source names a fixed version.