OS Command Injection in PTZOptics PT30X-SDI/NDI Cameras

Historical catalog analysis: CISA added this entry on November 04, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-8957 is an OS command injection vulnerability (CWE-78) affecting PTZOptics PT30X-SDI/NDI cameras. The flaw exists within the /cgi-bin/param.cgi CGI script, specifically involving the ntp_addr parameter. A remote, authenticated attacker can provide a crafted payload to this parameter to execute arbitrary operating system commands and escalate privileges to root.

Exposure and applicability

This vulnerability applies to organizations deploying PTZOptics PT30X-SDI/NDI camera hardware. Because the attack vector requires authentication, exposure is highest in environments where default credentials remain unchanged or where administrative access is granted to a broad set of users. The risk is further amplified for devices exposed to networks where authenticated attackers may already have a foothold.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be prioritized as a high-urgency task. Our analysis suggests the following priority sequence:

1. Asset Identification: Identify all PT30X-SDI/NDI units within the infrastructure to determine the total attack surface.
2. Firmware Update: Apply vendor-provided mitigations and firmware updates as specified in the official PTZOptics changelogs.
3. Access Restriction: If immediate patching is not feasible, restrict network access to the camera management interfaces to a limited set of trusted administrative IPs to reduce the likelihood of an authenticated attacker reaching the vulnerable script.
4. Decommissioning: In cases where vendor mitigations are unavailable or cannot be applied, the devices should be discontinued from use.

How to validate remediation

Verification must go beyond confirming a firmware version number. To ensure exposure is reduced, defenders should:
* Verify Patch Application: Confirm that the specific firmware version containing the fix for CVE-2024-8957 is active on the device.
* Configuration Audit: Ensure that administrative credentials have been rotated and are not using factory defaults, reducing the ease of authentication required to trigger the flaw.
* Network Validation: Use network mapping tools to verify that the /cgi-bin/param.cgi endpoint is no longer accessible from unauthorized network segments.

Limits and open questions

While firmware updates address the root cause, residual risk remains if administrative accounts are compromised via other means. It is currently unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, while CISA has established a deadline for federal agencies, non-federal organizations must determine their own remediation timelines based on their specific risk tolerance and asset criticality.

Source and editorial note

CVE-2024-8957: PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability · Source date: November 04, 2024 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 07, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: November 05, 2026 at 00:33 UTC.

Request a Vulnerability Assessment