1. What is this vulnerability and why does it matter?

This vulnerability, identified as CVE-2024-8957, is an OS command injection issue (CWE-78) affecting PTZOptics PT30X-SDI/NDI-xx cameras. It matters significantly because it allows for arbitrary OS command execution on affected devices. When chained with CVE-2024-8956, this vulnerability can be exploited by a remote and unauthenticated attacker, giving them complete control over the compromised camera. The ability to execute arbitrary commands without authentication presents a critical security risk, potentially leading to unauthorized surveillance, denial of service, or further network penetration.

2. What are the CVSS score, severity level, and disclosure details?

The CVSS score for CVE-2024-8957 is 7.2, which classifies its severity level as High. The vulnerability was publicly disclosed and published on 2024-09-17 20:08:25 UTC. The CVE details were last modified on 2025-12-27 16:47:39 UTC.

3. Which products, vendors, systems, and versions are affected?

• Vendor: PTZOptics
• Products: PTZOptics PT30X-SDI/NDI-xx series cameras
• Affected Versions: All firmware versions prior to 6.3.40

4. What is the technical root cause and attack vector?

The technical root cause of this vulnerability is insufficient validation of the ntp_addr configuration value within the camera's firmware. The system fails to properly sanitize or validate user-supplied input for the NTP address, allowing malicious commands to be embedded within this configuration. The attack vector involves exploiting this lack of validation, leading to arbitrary command execution when the ntp_client service is started. Specifically, a remote and unauthenticated attacker can leverage this flaw, particularly when chained with CVE-2024-8956, to inject and execute OS commands.

5. How can this vulnerability be exploited?

This vulnerability can be exploited by an attacker injecting arbitrary OS commands into the ntp_addr configuration value. When the ntp_client service on the PTZOptics camera is initiated or restarted, it will attempt to process this malformed NTP address, consequently executing the embedded commands. The description indicates that when this vulnerability (CVE-2024-8957) is chained with CVE-2024-8956, it enables a remote and unauthenticated attacker to successfully achieve arbitrary OS command execution on the affected devices.

6. What mitigation steps and patches are available?

The primary mitigation step for this vulnerability is to update the camera's firmware. Users should upgrade their PTZOptics PT30X-SDI/NDI-xx cameras to firmware version 6.3.40 or a later, patched version. This updated firmware addresses the insufficient validation issue related to the ntp_addr configuration value.

7. How can vulnerable systems be detected?

Vulnerable systems can be detected by checking the installed firmware version on PTZOptics PT30X-SDI/NDI-xx cameras. Any device running a firmware version older than 6.3.40 is considered vulnerable to CVE-2024-8957. Administrators should access the camera's administrative interface or utilize appropriate management tools to verify the current firmware version.

8. What are the indicators of compromise (IOCs)?

While specific IOCs directly from the CVE data are not provided, an OS command injection leading to arbitrary execution could manifest through the following general indicators:

• Unusual or unauthorized processes running on the camera's operating system.
• Unexpected outgoing network connections from the camera to unknown external IP addresses.
• Changes to the camera's configuration that were not initiated by an administrator.
• Presence of unusual files or directories on the camera's file system.
• Spikes in CPU or memory usage not attributable to normal camera operations.

9. Which threat actors are known to exploit this vulnerability?

The CVE data indicates that "Active exploits have been published to exploit the vulnerability," suggesting that threat actors are actively leveraging this flaw. However, the specific identities or affiliations of these threat actors are not detailed in the provided information.

10. What public intelligence references and advisories exist?

• CVE-2024-8957: This is the primary public reference detailing the OS command injection vulnerability.
• CVE-2024-8956: This related CVE is mentioned as a vulnerability that, when chained with CVE-2024-8957, facilitates remote and unauthenticated arbitrary OS command execution.

Further intelligence and advisories would typically be found through official vendor security bulletins (PTZOptics), national CERTs, and cybersecurity research outlets.

11. What is the risk assessment and urgency level?

The risk assessment for CVE-2024-8957 is High, as indicated by its CVSS score of 7.2. The vulnerability allows for arbitrary OS command execution, which can lead to complete compromise of the affected device. The urgency level is also High, especially given that active exploits have been published, and it can be exploited by remote and unauthenticated attackers when chained with CVE-2024-8956. Immediate patching to firmware version 6.3.40 or newer is strongly recommended to prevent potential exploitation and mitigate severe security risks.