CVE-2024-8957: ptzoptics pt30x-sdi firmware +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-8957

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 79,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada ptzoptics pt30x-sdi firmware, ptzoptics pt30x-ndi-xx-g2 firmware. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 4 November 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Rincian

Terbit di NVD: 17 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 79,8% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
Masuk KEV: 4 November 2024
Tenggat CISA: 25 November 2024 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
ptzoptics	pt30x-sdi firmware	Semua versi sebelum 6.3.40
ptzoptics	pt30x-ndi-xx-g2 firmware	Semua versi sebelum 6.3.40

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957 pemerintah AS
https://vulncheck.com/advisories/ptzoptics-command-injection advisory pihak ketiga
https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-came... advisory pihak ketiga
https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ exploit · advisory pihak ketiga
https://ptzoptics.com/firmware-changelog/ release notes

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.