CVE-2024-8957

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

• CWE-78
• CWE-78

• https://ptzoptics.com/firmware-changelog/Release Notes
• https://vulncheck.com/advisories/ptzoptics-command-injectionThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957US Government Resource
• https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-aiThird Party Advisory
• https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/Exploit, Third Party Advisory

Published

Sep 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8951A vulnerability classified as problematic was found in Sourc…6.1
• CVE-2024-8952A Server-Side Request Forgery (SSRF) vulnerability exists in…7.5
• CVE-2024-8953In composiohq/composio version 0.4.3, the mathematical_calcu…9.8
• CVE-2024-8954In composiohq/composio version 0.5.10, the API does not vali…9.8
• CVE-2024-8955A Server-Side Request Forgery (SSRF) vulnerability exists in…7.5
• CVE-2024-8956PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnera…9.1
• CVE-2024-8958In composiohq/composio version 0.4.3, there is an unrestrict…9.8
• CVE-2024-8959The WP Adminify – Custom WordPress Dashboard, Login and Admi…6.4
• CVE-2024-8960The Cowidgets – Elementor Addons plugin for WordPress is vul…5.4
• CVE-2024-8961The Essential Addons for Elementor – Best Elementor Addon, T…5.4
• CVE-2024-8962The WPBITS Addons For Elementor Page Builder plugin for Word…5.4
• CVE-2024-8963Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows…9.1