CVE-2024-8957

What it actually does

This vulnerability is an OS command injection flaw in PTZOptics PT30X-SDI/NDI camera firmware before version 6.3.40. The device insufficiently validates the NTP server configuration value, identified as ntp_addr, before passing it to the ntp_client startup logic. An attacker who can modify that value can inject shell metacharacters or command substitutions so that arbitrary operating system commands execute with the privileges of the camera service. When chained with CVE-2024-8956, the attack can be performed remotely without authentication, turning an exposed camera into a remotely controllable embedded Linux device.

Why it matters to the business

Successful exploitation can allow attackers to take control of affected PTZOptics cameras, disrupt video operations, pivot through the network, install persistence, or use the devices as part of botnets and internal reconnaissance. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, organizations should treat internet-accessible or unsegmented affected cameras as high-priority remediation targets. CISA’s KEV remediation deadline was 2024-11-25, so any remaining exposure is overdue and should be considered an elevated operational risk.

How an attack unfolds

An attacker first identifies an exposed PTZOptics PT30X-SDI/NDI camera running firmware earlier than 6.3.40. If authentication is required, the attacker may chain CVE-2024-8956 to reach the vulnerable configuration workflow without valid credentials. The attacker then submits a crafted NTP server value containing shell syntax, such as command separators, pipes, backticks, or command substitution. When the camera starts or restarts the NTP client, the malicious ntp_addr value is incorporated into an operating system command without safe validation or quoting. The injected command executes on the device, allowing the attacker to download tools, create persistence, alter configuration, scan internal networks, exfiltrate data available to the device, or enroll the camera into a botnet.

How to fix it

Upgrade affected PTZOptics PT30X-SDI/NDI cameras to firmware version 6.3.40 or later. If immediate firmware deployment is not possible, remove internet exposure, restrict management access to a dedicated administrative network or VPN, block untrusted access to camera administration interfaces, and monitor or disable NTP configuration changes until patched. Rotate camera administrative credentials after remediation, especially if the device was exposed before patching. Review firewall rules to ensure cameras cannot initiate arbitrary outbound connections except to approved services such as trusted NTP servers, firmware update endpoints, and required video management systems.

How to confirm the fix worked

Confirm each PTZOptics PT30X-SDI/NDI device is running firmware 6.3.40 or later from the device administration interface or vendor-supported inventory tooling. Validate that camera management interfaces are not reachable from the public internet and are accessible only from authorized administrative networks. Review the NTP server configuration and ensure ntp_addr contains only a legitimate hostname or IP address, with no shell metacharacters, encoded delimiters, command substitutions, or unexpected whitespace. Where safe and authorized, perform a configuration test using benign invalid characters to confirm the patched firmware rejects unsafe NTP values rather than passing them to ntp_client.

Typical attack path

1. Scan for exposed PTZOptics PT30X-SDI/NDI cameras or discover them inside a network.
2. Fingerprint the device model and firmware version to identify firmware earlier than 6.3.40.
3. Use the authentication bypass or access-control weakness in CVE-2024-8956 if credentials are not available.
4. Submit a malicious NTP configuration value through the camera management interface or API.
5. Trigger ntp_client startup or wait for the device to apply/restart the NTP configuration.
6. Execute arbitrary shell commands on the camera through the injected ntp_addr value.
7. Download additional payloads, establish persistence, scan adjacent systems, or use the camera as a foothold.

How to detect it

Investigate both management-plane activity and device behavior. Review camera administrative logs, web access logs, configuration-change logs, syslog output, and any centralized NVR or device-management logs for changes to NTP settings, especially values containing shell metacharacters or URL-encoded command separators. Look for ntp_client restarts followed by unexpected child processes, outbound HTTP/HTTPS requests, DNS lookups, file downloads, or connections to unfamiliar IP addresses. On the device, if shell access or forensic collection is available, inspect configuration files, startup scripts, cron entries, writable temporary directories, and process lists for unauthorized commands or payloads. Network telemetry should be reviewed for cameras initiating connections unrelated to expected NTP, video, management, or vendor update traffic. Because this vulnerability is known to be exploited in the wild, treat suspicious NTP configuration changes on affected firmware as potential compromise and preserve logs before rebooting or factory resetting devices.

• ntp_addr=;
• ntp_addr=%3B
• ntp_addr=|
• ntp_addr=%7C
• ntp_addr=`
• ntp_addr=%60
• ntp_addr=$(
• ntp_addr=%24%28
• ntp_addr=&&
• ntp_addr=%26%26
• ntp_addr=||
• ntp_addr=%7C%7C
• ntp_addr=>
• ntp_addr=%3E
• ntp_addr=<
• ntp_addr=%3C
• ntp_addr=wget
• ntp_addr=curl
• ntp_addr=tftp
• ntp_addr=nc
• ntp_addr=telnet
• ntp_addr=busybox
• ntp_client
• /tmp/
• /var/tmp/

What your security team should do

• Immediately inventory PTZOptics PT30X-SDI/NDI cameras and identify firmware versions earlier than 6.3.40.
• Prioritize remediation of internet-facing, third-party-accessible, or flat-network camera deployments because exploitation is active in the wild and the vulnerability is in CISA KEV.
• Upgrade affected devices to firmware 6.3.40 or later, then reboot and verify the reported firmware version.
• Restrict camera administration interfaces to trusted management networks or VPNs only; do not expose them directly to the internet.
• Review NTP configuration values for command-injection characters and reset them to approved internal or trusted NTP servers.
• Inspect logs, configuration backups, and network telemetry for evidence of suspicious ntp_addr changes or unexpected outbound connections from cameras.
• Rotate camera credentials and any shared administrative credentials after patching if exposure or compromise is suspected.
• Apply egress filtering so cameras cannot download payloads or initiate arbitrary outbound connections to the internet.
• Segment cameras from business-critical systems to reduce pivoting risk from compromised video devices.