CVE-2024-8957: PTZOptics PT30X Camera RCE Vulnerability

CVE-2024-8957 Overview

CVE-2024-8957 is a critical OS command injection vulnerability affecting PTZOptics PT30X-SDI/NDI-xx cameras running firmware versions prior to 6.3.40. The vulnerability exists due to insufficient validation of the ntp_addr configuration value, which allows attackers to inject arbitrary OS commands that execute when the ntp_client service is started. When chained with CVE-2024-8956 (an authentication bypass), this vulnerability enables remote, unauthenticated attackers to achieve full command execution on vulnerable devices.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Remote attackers can execute arbitrary operating system commands on affected PTZOptics cameras without authentication when combined with CVE-2024-8956, potentially leading to complete device compromise, network pivoting, and surveillance interception.

Affected Products

• PTZOptics PT30X-SDI firmware versions before 6.3.40
• PTZOptics PT30X-NDI-xx-G2 firmware versions before 6.3.40
• PTZOptics PT30X-SDI hardware devices
• PTZOptics PT30X-NDI-xx-G2 hardware devices

Discovery Timeline

• 2024-09-17 - CVE-2024-8957 published to NVD
• 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2024-8957

Vulnerability Analysis

This OS command injection vulnerability (CWE-78) stems from improper input validation in the camera's NTP configuration handling. The affected PTZOptics cameras accept user-supplied input for the ntp_addr configuration parameter without adequately sanitizing special characters or shell metacharacters. When the ntp_client service processes this configuration value, the unsanitized input is passed to a system shell, allowing command injection.

The vulnerability is particularly dangerous because it can be chained with CVE-2024-8956, an authentication bypass vulnerability in the same product line. This combination allows completely unauthenticated attackers to remotely execute arbitrary commands on the camera's underlying operating system over the network without requiring any user interaction.

Root Cause

The root cause is insufficient input validation and sanitization of the ntp_addr configuration parameter. The camera's firmware fails to properly validate or escape user-supplied NTP server addresses before incorporating them into shell commands executed by the ntp_client service. This allows shell metacharacters and command separators to be injected, breaking out of the intended command context and executing attacker-controlled commands.

Attack Vector

The attack is network-based and can be executed remotely. An attacker first exploits CVE-2024-8956 to bypass authentication mechanisms on the PTZOptics camera. Once authenticated access is obtained, the attacker modifies the ntp_addr configuration value to include malicious shell commands. When the NTP client service starts or restarts, these injected commands are executed with the privileges of the service process.

The attack requires no user interaction and can be fully automated. Given that these cameras are often deployed in corporate, educational, and government environments for live streaming and video conferencing, successful exploitation could lead to:

• Complete device takeover
• Interception or manipulation of video streams
• Use of compromised cameras as pivot points for lateral movement
• Installation of persistent backdoors
• Participation in botnet activities

For detailed technical analysis, refer to the VulnCheck Command Injection Advisory and the GreyNoise Grimoire SIFT 0-Day RCE documentation.

Detection Methods for CVE-2024-8957

Indicators of Compromise

• Unexpected modifications to NTP configuration settings containing shell metacharacters (;, |, $(), backticks)
• Unusual outbound network connections from PTZOptics cameras to unknown IP addresses
• Anomalous process execution on camera devices, especially shells spawned by ntp_client
• Evidence of firmware version below 6.3.40 on exposed PTZOptics PT30X devices

Detection Strategies

• Monitor network traffic for exploitation attempts targeting PTZOptics camera web interfaces
• Implement intrusion detection rules to identify command injection patterns in HTTP requests to camera configuration endpoints
• Audit configuration changes on PTZOptics devices, specifically monitoring the ntp_addr parameter for suspicious values
• Use network segmentation and monitor for unusual traffic patterns from IoT camera segments

Monitoring Recommendations

• Deploy network monitoring to detect connections from cameras to unexpected external hosts
• Establish baseline behavior for PTZOptics cameras and alert on deviations
• Review camera logs for unauthorized configuration changes or authentication bypass attempts
• Implement honeypot cameras with vulnerable firmware to detect active exploitation campaigns

How to Mitigate CVE-2024-8957

Immediate Actions Required

• Update all PTZOptics PT30X-SDI and PT30X-NDI-xx-G2 cameras to firmware version 6.3.40 or later immediately
• Isolate vulnerable cameras on a segmented network with restricted internet access until patching is complete
• Audit camera configurations for signs of compromise, particularly unusual ntp_addr values
• Review network logs for evidence of exploitation attempts against PTZOptics devices

Patch Information

PTZOptics has released firmware version 6.3.40 which addresses this command injection vulnerability. Administrators should download the latest firmware from the PTZOptics Firmware Changelog page and apply updates to all affected devices. Given the active exploitation status and inclusion in the CISA KEV catalog, patching should be treated as an emergency priority.

Workarounds

• Place PTZOptics cameras behind a firewall and restrict access to trusted IP addresses only
• Disable internet-facing access to camera management interfaces until patches can be applied
• Implement network access controls to prevent unauthorized configuration changes
• Monitor and restrict outbound connections from camera devices to known-good destinations
• Consider temporarily disabling NTP client functionality if it is not operationally required

# Network isolation example using iptables on a Linux router
# Restrict camera subnet to only necessary communications

# Allow camera to communicate with local NTP server only
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.10 -p udp --dport 123 -j ACCEPT

# Allow camera to reach firmware update server
iptables -A FORWARD -s 192.168.10.0/24 -d ptzoptics.com -p tcp --dport 443 -j ACCEPT

# Block all other outbound from camera subnet
iptables -A FORWARD -s 192.168.10.0/24 -j DROP