CVE-2024-8957
📋 TL;DR
CVE-2024-8957 is an OS command injection vulnerability in PTZOptics PT30X-SDI/NDI cameras that allows arbitrary command execution via insufficient validation of the ntp_addr configuration value. When chained with CVE-2024-8956, remote unauthenticated attackers can execute commands on affected devices. Organizations using PTZOptics PT30X-SDI/NDI cameras with firmware before 6.3.40 are affected.
💻 Affected Systems
- PTZOptics PT30X-SDI/NDI-xx series cameras
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to camera control takeover, network pivoting, data exfiltration, and persistent backdoor installation.
Likely Case
Camera hijacking for unauthorized surveillance, denial of service, or use as network foothold for lateral movement.
If Mitigated
Limited impact through network segmentation and proper access controls, though device functionality may still be disrupted.
🎯 Exploit Status
Exploitation is publicly documented and weaponized. CISA has added this to Known Exploited Vulnerabilities catalog. GreyNoise has observed active exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware 6.3.40 or later
Vendor Advisory: https://ptzoptics.com/firmware-changelog/
Restart Required: Yes
Instructions:
1. Download firmware 6.3.40+ from PTZOptics support portal. 2. Upload firmware via camera web interface. 3. Apply update and restart camera. 4. Verify firmware version after reboot.
🔧 Temporary Workarounds
Disable NTP Client Service
linuxTemporarily disable the vulnerable ntp_client service to prevent exploitation
ssh admin@camera_ip 'systemctl stop ntp_client'
ssh admin@camera_ip 'systemctl disable ntp_client'
Network Segmentation
allIsolate cameras on separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Immediately isolate affected cameras from internet and critical networks
- Implement strict network access controls allowing only necessary camera management traffic
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at http://camera_ip/settings/system or SSH with 'cat /etc/version'Check Version:
ssh admin@camera_ip 'cat /etc/version' or curl -s http://camera_ip/api/versionVerify Fix Applied:
Confirm firmware version is 6.3.40 or higher and test ntp_addr field validation📡 Detection & Monitoring
Log Indicators:
- Unusual ntp configuration changes
- Suspicious process execution in system logs
- Failed authentication attempts followed by configuration changes
Network Indicators:
- Unexpected outbound connections from cameras
- NTP traffic to non-standard servers
- SSH/RDP connections originating from cameras
SIEM Query:
source="camera_logs" AND ("ntp_addr" OR "systemctl" OR "bash -c") AND NOT user="admin"🔗 References
- https://ptzoptics.com/firmware-changelog/
- https://vulncheck.com/advisories/ptzoptics-command-injection
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8957
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/
