Live › vulnerability › CVE-2024-8956
Go to dashboardPTZOptics PT30X-SDI/NDI cameras have an authentication bypass in the /cgi-bin/param.cgi endpoint. A remote attacker can reach camera settings without logging in, and combined with CVE-2024-8957 can run code as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PTZOptics PT30X-SDI/NDI Cameras | vendor | – | – |
| ptzoptics pt30x-sdi firmware | vendor | < 6.3.40 | 6.3.40 |
| ptzoptics pt30x-ndi-xx-g2 firmware | vendor | < 6.3.40 | 6.3.40 |
Unknown from the sources.
Apply the mitigations from the vendor per CISA guidance, or discontinue use of the product if no mitigation is available.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
This page as .md · .json · in your agent: get_signal("CVE-2024-8956")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.