CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Nov 25, 2024

CVE-2024-8957

High

EPSS 55.5%CISA KEV

PTZOptics/PT30X-SDI/NDI Cameras

Description

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

EPSS — Exploit Probability

55.5%

Higher than 98.0% of all CVEs

Required Action

https://ptzoptics.com/firmware-changelog/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-8957

Risk Assessment

HIGH

In CISA KEV

High EPSS

Details

Severity: High
EPSS: 55.5%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Nov 4, 2024

Added to KEV

Nov 4, 2024

Remediation Due

Nov 25, 2024

Affected Product

PTZOptics

PT30X-SDI/NDI Cameras

View all PTZOptics CVEs

External Links

NVD (NIST)CVE Details MITRE CVE