PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-11-04
• EPSS: 59% chance of exploitation in the next 30 days (higher than 99% of CVEs)
• Critical severity: CVSS 9.1

[ Description ]Official description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

CISA: PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Nov 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• ptzoptics.com/firmware-changelogRelease Notes
• vulncheck.com/advisories/ptzoptics-insufficient-authThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource
• www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live…Third Party Advisory
• www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rceExploitThird Party Advisory