CVE-2024-8956: PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Q: What is the severity of CVE-2024-8956?

CVE-2024-8956 is categorized as a critical vulnerability due to the potential for remote code execution.

Q: How does CVE-2024-8956 exploit insecure direct object reference?

CVE-2024-8956 allows attackers to bypass authentication through insecure direct object reference in the /cgi-bin/param.cgi CGI script.

Q: Which PTZOptics products are affected by CVE-2024-8956?

CVE-2024-8956 affects the PTZOptics PT30X-SDI and PT30X-NDI cameras running firmware versions up to 6.3.40.

Q: How can I mitigate CVE-2024-8956?

Mitigation for CVE-2024-8956 involves updating the affected PTZOptics cameras to a patched firmware version.

Q: What is the relationship between CVE-2024-8956 and CVE-2024-8957?

CVE-2024-8956 can be combined with CVE-2024-8957 to potentially allow remote code execution as root.

Published Sep 17, 2024

Updated

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

Other sources

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

— NVD

Affected Software

45 affected components

PTZOptics PT30X-SDI/NDI Cameras

All of the following

PTZOptics Pt30x-sdi Firmware<6.3.40

PTZOptics PT30X-SDI

All of the following

PTZOptics Pt30x-ndi-xx-g2 Firmware<6.3.40

PTZOptics Pt30x-ndi-xx-g2

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-SDI-xx-G2: Versions 6.3.34 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-NDI-xx: Versions 6.3.34 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-USB-xx-G2: Versions 6.2.81 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-SDI-xx-G2: Versions 6.3.20 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-NDI-xx: Versions 6.3.20 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-USB-xx-G2: Versions 6.2.73 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-SDI-xx-G2: Versions 6.3.30 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-NDI-xx: Versions 6.3.30 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-ZCAM: Versions 7.2.76 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-ZCAM: Versions 7.2.82 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTVL-ZCAM: Versions 7.2.79 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTEPTZ-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTEPTZ-NDI-ZCAM-G2: Versions 8.1.81 and prior (CVE-2025-35451)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-SDI-xx-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-NDI-xx: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-USB-xx-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-SDI-xx-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOpticsPT20X-NDI-xx: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-USB-xx-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-SDI-xx-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-NDI-xx: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-ZCAM: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-ZCAM: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTVL-ZCAM: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTEPTZ-ZCAM-G2: All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTEPTZ-NDI-ZCAM-G2 All versions (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-4K-xx-G3: Versions 0.0.58 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-4K-xx-G3: Versions 0.0.85 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-4K-xx-G3: Versions 2.0.64 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-LINK-4K-xx: Versions 0.0.63 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-LINK-4K-xx: Versions 0.0.89 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-LINK-4K-xx: Versions 2.0.71 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT12X-SE-xx-G3: Versions 9.1.43 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT20X-SE-xx-G3: Versions 9.1.32 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT30X-SE-xx-G3: Versions 9.1.33 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PT-STUDIOPRO: Versions 9.0.41 and prior (CVE-2025-35452)

: ValueHD, PTZOptics, multiCAM Systems, SMTAV PTZOptics PTZOptics VL Fixed Camera/NDI Fixed Camera<=7.2.94

: ValueHD, PTZOptics, multiCAM Systems, SMTAV SMTAV Pan-Tilt-Zoom Cameras

: ValueHD, PTZOptics, multiCAM Systems, SMTAV multiCAM Systems Pan-Tilt-Zoom Cameras

: ValueHD, PTZOptics, multiCAM Systems, SMTAV ValueHD Pan-Tilt-Zoom Cameras

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PTZOptics PT30X-SDI/NDI-xx to a version that resolves this vulnerability.
Fixed in 6.3.40
Compensating control
Discontinue use of the product if mitigations are unavailable.

Event History

Dec 4, 2023

News Published

06:01 AM

Dec 18, 2023

News Published

02:25 AM

Jan 15, 2024

News Published

03:34 PM

Apr 29, 2024

News Published

02:29 AM

May 6, 2024

News Published

02:30 AM

May 13, 2024

News Published

02:21 AM

Jun 3, 2024

News Published

12:02 PM

Jul 1, 2024

News Published

03:35 AM

Jul 22, 2024

News Published

03:44 AM

Sep 17, 2024

CVE Published

via MITRE·07:59 PM

Data Sourced

via MITRE·07:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Sep 30, 2024

News Published

03:02 AM

Oct 31, 2024

News Published

via BleepingComputer·06:23 PM

News Published

via BleepingComputer·06:24 PM

Nov 4, 2024

Known Exploited

via CISA·12:00 AM

Nov 11, 2024

News Published

03:28 AM

Sep 8, 2025

News Published

via The Register·11:46 AM

News Published

via The Register·11:49 AM

Sep 9, 2025

Data Sourced

via ICS·05:55 PM

SeverityWeaknessAffected Software

Updated

via ICS·05:55 PM

SeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-162-10

Frequently Asked Questions

What is the severity of CVE-2024-8956?

CVE-2024-8956 is categorized as a critical vulnerability due to the potential for remote code execution.

How does CVE-2024-8956 exploit insecure direct object reference?

CVE-2024-8956 allows attackers to bypass authentication through insecure direct object reference in the /cgi-bin/param.cgi CGI script.

Which PTZOptics products are affected by CVE-2024-8956?

CVE-2024-8956 affects the PTZOptics PT30X-SDI and PT30X-NDI cameras running firmware versions up to 6.3.40.

How can I mitigate CVE-2024-8956?

Mitigation for CVE-2024-8956 involves updating the affected PTZOptics cameras to a patched firmware version.

What is the relationship between CVE-2024-8956 and CVE-2024-8957?

CVE-2024-8956 can be combined with CVE-2024-8957 to potentially allow remote code execution as root.

CVE-2024-8956: PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2024-8956?

How does CVE-2024-8956 exploit insecure direct object reference?

Which PTZOptics products are affected by CVE-2024-8956?

How can I mitigate CVE-2024-8956?

What is the relationship between CVE-2024-8956 and CVE-2024-8957?

Company

Resources

Contact