CVE-2024-8956

What it actually does

CVE-2024-8956 is an authentication bypass in PTZOptics PT30X-SDI/NDI camera firmware before 6.3.40. The embedded web interface fails to enforce authentication for requests to /cgi-bin/param.cgi when the HTTP Authorization header is omitted. A remote unauthenticated attacker who can reach the camera management interface can read sensitive configuration data, including usernames, password hashes, and device settings, and can also modify individual configuration parameters or overwrite the full configuration file. This can lead to credential exposure, unauthorized camera control, persistence through configuration changes, and disruption of video operations.

Why it matters to the business

Successful exploitation can expose camera administrator credentials and sensitive configuration details, allow unauthorized changes to camera settings, disrupt video production or monitoring workflows, and potentially provide attackers with credentials useful for broader network access if passwords are reused. The vulnerability is listed in CISA KEV with a remediation due date of 2024-11-25, has active exploitation in the wild, and has a high EPSS score, so internet-accessible or broadly reachable camera management interfaces should be treated as urgent remediation targets.

How an attack unfolds

An attacker first identifies a reachable PTZOptics PT30X-SDI/NDI camera web interface, commonly by scanning for exposed HTTP/HTTPS management services or known camera fingerprints. Instead of authenticating normally, the attacker sends crafted requests directly to /cgi-bin/param.cgi while omitting the HTTP Authorization header. Because vulnerable firmware does not properly enforce authentication in that condition, the endpoint may return configuration data that should be restricted, including account information, password hashes, network settings, and device configuration. The attacker can then use the same endpoint to alter configuration values or overwrite configuration content, potentially changing credentials, redirecting streams, modifying network settings, disabling functionality, or creating operational disruption. If leaked credentials are reused elsewhere, the attacker may attempt lateral movement against other systems. This vulnerability is known to be exploited in the wild and is included in the CISA Known Exploited Vulnerabilities catalog.

How to fix it

Upgrade PTZOptics PT30X-SDI/NDI cameras to firmware version 6.3.40 or later. If immediate upgrade is not possible, restrict access to the camera management interface using network segmentation, firewall rules, VPN-only administration, and allowlists for trusted administrative workstations. Do not expose camera management interfaces directly to the internet. Rotate camera credentials after patching, especially if the device was externally reachable or logs show access to /cgi-bin/param.cgi. Review and restore camera configuration from a trusted baseline if unauthorized changes are suspected. Where supported, disable unnecessary services, enforce strong unique passwords, and place cameras on isolated networks with no direct access to sensitive internal systems.

How to confirm the fix worked

Confirm each PTZOptics PT30X-SDI/NDI camera is running firmware 6.3.40 or later through the device web UI, vendor management tools, or authenticated device inventory. Validate exposure by checking whether the camera management interface is reachable from untrusted networks or the internet. As a controlled test, request /cgi-bin/param.cgi without an HTTP Authorization header from an approved test host; patched or properly protected systems should deny access or require authentication and should not disclose configuration data. Review firewall, reverse proxy, and access-control rules to verify only trusted administrative sources can reach the management interface. After remediation, confirm credentials have been rotated and configuration values match the approved baseline.

Typical attack path

1. Scan for exposed PTZOptics PT30X-SDI/NDI camera web interfaces or management ports.
2. Fingerprint the device and firmware family using HTTP responses, web UI artifacts, banners, or camera-specific endpoints.
3. Send unauthenticated requests to /cgi-bin/param.cgi without an HTTP Authorization header.
4. Read sensitive configuration data returned by the vulnerable endpoint, including usernames, password hashes, and device settings.
5. Use the endpoint to modify individual configuration values or overwrite the configuration file.
6. Leverage changed settings for persistence, disruption, credential theft, unauthorized camera control, or further network access.

How to detect it

Investigate HTTP access logs from the camera, upstream reverse proxies, load balancers, VPN gateways, firewalls, and network sensors for requests to /cgi-bin/param.cgi. Prioritize requests from external or unexpected IP addresses, requests lacking an Authorization header, and requests followed by configuration changes, device reboots, streaming changes, account changes, or network setting changes. If full packet capture or HTTP metadata is available, look for GET or POST requests to the endpoint without authentication. Review device audit logs, if available, for configuration writes that do not correlate with authorized administrative activity. Compare current device configuration against a known-good backup or deployment baseline. Examine account lists, password hashes, network settings, DNS/NTP settings, RTSP/NDI/SDI streaming configuration, and remote access settings for unauthorized changes. Because exploitation is active in the wild and the issue is in CISA KEV, absence of device-local logs should not be considered proof of non-exploitation; use network telemetry and configuration integrity review as compensating evidence.

• /cgi-bin/param.cgi
• GET /cgi-bin/param.cgi
• POST /cgi-bin/param.cgi
• /cgi-bin/param.cgi?
• HTTP request to /cgi-bin/param.cgi without Authorization header
• param.cgi

What your security team should do

• Immediately identify all PTZOptics PT30X-SDI/NDI cameras and determine firmware versions and network exposure.
• Prioritize internet-facing or broadly reachable cameras for upgrade to firmware 6.3.40 or later.
• Because this vulnerability is in CISA KEV and exploited in the wild, treat unpatched exposed devices as potentially compromised until reviewed.
• Restrict management access to trusted administrative networks or VPNs; block direct internet access to camera web interfaces.
• Search web server, reverse proxy, firewall, and network telemetry for unauthenticated requests to /cgi-bin/param.cgi.
• Rotate camera credentials after patching, and rotate any reused credentials that may have been exposed in device configuration.
• Review device configuration for unauthorized changes, including account, network, streaming, DNS, NTP, and remote access settings.
• Create SIEM detections for access to /cgi-bin/param.cgi, especially requests without Authorization headers or from unusual external IP addresses.