Multiple vulnerabilities in PTZOptics PT30X-SDI/NDI-xx IP camera



Published: 2024-11-01
Risk Critical
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2024-8956
CVE-2024-8957
CWE-ID CWE-287
CWE-78
Exploitation vector Network
Public exploit Vulnerability #1 is being exploited in the wild.
Vulnerability #2 is being exploited in the wild.
Vulnerable software
Subscribe 		PT30X-SDI/NDI-xx
Hardware solutions / Office equipment, IP-phones, print servers

Vendor PTZOptics

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authentication

EUVDB-ID: #VU99606

Risk: Critical

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-8956

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication checks in /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. A remote non-authenticated attacker can gain unauthorized access to the IP camera and obtain sensitive information, such as usernames, password hashes, and configurations details or update camera configuration.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PT30X-SDI/NDI-xx: 6.2.50 - 6.3.32

CPE2.3 External links

http://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
http://ptzoptics.com/firmware-changelog/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) OS Command Injection

EUVDB-ID: #VU99607

Risk: Critical

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-8957

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling the ntp_addr configuration value. A remote user can set a specially crafted value in the configuration file and execute arbitrary OS commands on the system.

Note, this vulnerability can be also exploited by an unauthenticated attacker if chained with #VU99606 (CVE-2024-8956).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PT30X-SDI/NDI-xx: 6.2.50 - 6.3.32

CPE2.3 External links

http://ptzoptics.com/firmware-changelog/
http://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.



###SIDEBAR###