CVE-2024-8956
criticalPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.588 · 99. PerzentilEURUUShinzugefügt 2024-11-04beheben bis 2024-11-25
erforderliche Maßnahme Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS · bewertet 2026-10-27
PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationPTZOptics PTZOptics VL Fixed Camera/NDI Fixed Cameracisa_csaf_ot
ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:
- MitigationSMTAV Pan-Tilt-Zoom Camerascisa_csaf_ot
ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:
- MitigationValueHD Pan-Tilt-Zoom Camerascisa_csaf_ot
ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:
- MitigationmultiCAM Systems Pan-Tilt-Zoom Camerascisa_csaf_ot
ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (14)
Betroffene Produkte und Versionsbereiche.
- ptzoptics pt30x-ndi-xx-g2 firmware< 6.3.40nvdUScpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-25-162-10PTZOptics and Other Pan-Tilt-Zoom Cameras2025-06-12icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-8956/cnnvd
- https://ptzoptics.com/firmware-changelog/cnnvd
- https://vulncheck.com/advisories/ptzoptics-insufficient-authcnnvd
- https://ptzoptics.com/firmware-changelog/enisa_euvd
- https://vulncheck.com/advisories/ptzoptics-insufficient-authenisa_euvd
- https://ptzoptics.com/firmware-changelog/Release Notesnvd
- https://vulncheck.com/advisories/ptzoptics-insufficient-authThird Party Advisorynvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956US Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan