CVE-2024-8956

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.588 · 99 %ileEURUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV
Likely / severe?
58.8% (99th) EPSS
CVSS 9.1 · critical
Is it mine?
14 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

added 2024-11-04remediate by 2024-11-25

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationPTZOptics PTZOptics VL Fixed Camera/NDI Fixed Cameracisa_csaf_ot

    ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:

  • MitigationSMTAV Pan-Tilt-Zoom Camerascisa_csaf_ot

    ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:

  • MitigationValueHD Pan-Tilt-Zoom Camerascisa_csaf_ot

    ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:

  • MitigationmultiCAM Systems Pan-Tilt-Zoom Camerascisa_csaf_ot

    ValueHD, multiCAM Systems, and SMTAV did not respond to requests for coordination. Please contact the respective companies through the following means for more information:

02

cvss

Technical severity, 0–10. One row per scoring source.

9.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · CISA US
v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · disclosure@vulncheck.comexploitability 3.9 · impact 5.2
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-287USCWE-287USCWE-306US
05

affected products (14)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-25-162-10PTZOptics and Other Pan-Tilt-Zoom Cameras2025-06-12icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to leak sensitive data, execute arbitrary commands, and access the admin web interface using hard-coded credentials.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdNVDCVE.orgMITRE
published 2024-09-17modified 2026-06-17
10

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan