{"id":"CVE-2024-8956","kind":"vulnerability","aliases":["CVE-2024-8956"],"related":[],"title":"PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue","description":"PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.","summary":"PTZOptics PT30X-SDI/NDI cameras have an authentication bypass in the /cgi-bin/param.cgi endpoint. A remote attacker can reach camera settings without logging in, and combined with CVE-2024-8957 can run code as root.","severity":"critical","cvss":9.1,"epss":null,"exploited":true,"exploited_at":"2024-11-04T00:00:00+00:00","products":[{"name":"PTZOptics PT30X-SDI/NDI Cameras","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ptzoptics pt30x-sdi firmware","fixed":["6.3.40"],"affected":"< 6.3.40","ecosystem":"vendor"},{"name":"ptzoptics pt30x-ndi-xx-g2 firmware","fixed":["6.3.40"],"affected":"< 6.3.40","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ip-cameras","pt30x-ndi","pt30x-sdi","ptzoptics"],"not_affected_if":["camera-not-internet-exposed"],"how_to_check":null,"fix":"Apply the mitigations from the vendor per CISA guidance, or discontinue use of the product if no mitigation is available.","status":"open","published_at":"2024-09-17T20:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:20+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor per CISA guidance, or discontinue use of the product if no mitigation is available.","reach":"network","impact":"high","summary":"PTZOptics PT30X-SDI/NDI cameras have an authentication bypass in the /cgi-bin/param.cgi endpoint. A remote attacker can reach camera settings without logging in, and combined with CVE-2024-8957 can run code as root.","category":"infrastructure","who_cares":["ptzoptics","pt30x-sdi","pt30x-ndi","ip-cameras"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker bypasses login and, chained with CVE-2024-8957, runs code as root.","analyst_note":"Find the vendor advisory and firmware versions that fix CVE-2024-8956 and CVE-2024-8957; the sources give no fixed version or check method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["camera-not-internet-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2908,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':17A,20A,80B '-8956':18A,21A '-8957':81B '/cgi-bin/param.cgi':64B,110C '/ndi':26A,56B '/ndi-xx':5A,91C '6.3.40':8A,94C 'addit':140C 'attack':68B,127C,142C 'authent':14A,60B,100C,108C 'author':118C 'bypass':61B 'camera':44B,57B,71B,103C 'cameras':27A 'code':84B 'combin':77B 'configur':138C,146C 'cve':16A,19A,79B 'data':131C 'detail':139C 'endpoint':65B 'enforc':107C 'exploit':40B 'file':152C 'firmwar':7A,93C 'firmware':32A,39A 'g2':38A 'hash':136C 'header':119C 'http':117C 'individu':145C 'infrastructur':41B 'insuffici':13A,99C 'ip':43B 'ip-camera':42B 'issu':15A,101C 'leak':129C 'log':74B 'ndi':36A,47B 'overwrit':149C 'password':135C 'proper':106C 'pt30x':3A,24A,30A,35A,46B,49B,54B,89C 'pt30x-ndi':45B 'pt30x-ndi-xx-g2':34A 'pt30x-sdi':2A,23A,29A,48B,53B,88C 'ptzoptic':1A,51B,52B,87C 'ptzoptics':22A,28A,33A 'reach':70B 'remot':67B,124C 'request':112C 'result':121C 'root':86B 'run':83B 'sdi':4A,25A,31A,50B,55B,90C 'sensit':130C 'sent':114C 'set':72B 'unauthent':126C 'updat':144C 'usernam':134C 'valu':147C 'vulner':10A,96C 'whole':151C 'without':73B,115C 'xx':37A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-17T20:15:07+00:00","kev":{"dateAdded":"2024-11-04","dueDate":"2024-11-25","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-8956","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-8956","severity":null,"published_at":"2024-11-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-8956","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8956","severity":null,"published_at":"2024-09-17T20:15:07+00:00","modified_at":"2026-06-17T08:23:37+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}