CVE-2024-8956PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
Explotación conocida — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability
CISA confirmó el 04.11.2024 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 25.11.2024.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://ptzoptics.com/firmware-changelog/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-8956
Descripción
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| PTZOptics | PT30X-NDI | < 6.3.40 | |
| ptzoptics | pt30x-ndi-xx-g2 | 0 – < 6.3.40 | |
| ptzoptics | pt30x-ndi-xx-g2_firmware | < 6.3.40 | |
| PTZOptics | PT30X-SDI | < 6.3.40 | |
| ptzoptics | pt30x-sdi_firmware | < 6.3.40 |
Referencias y parches
- https://ptzoptics.com/firmware-changelog/ vendor-advisoryRelease Notes
- https://vulncheck.com/advisories/ptzoptics-insufficient-auth third-party-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956 US Government Resource
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cam… Third Party Advisory
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/ ExploitThird Party Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:o:ptzoptics:pt30x-sdi_firmware:*:*:*:*:*:*:*:*< 6.3.40cpe:2.3:o:ptzoptics:pt30x-ndi-xx-g2_firmware:*:*:*:*:*:*:*:*< 6.3.40