CVE-2024-8957: PTZOptics PT30X cameras OS command injection via ntp_addr

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score and public exploit references, and chaining yields unauthenticated remote code execution.

What it is

PTZOptics PT30X-SDI/NDI-xx cameras before firmware 6.3.40 fail to validate the ntp_addr configuration value, allowing OS command injection when ntp_client starts. Chained with CVE-2024-8956, a remote unauthenticated attacker can run arbitrary OS commands on the device.

Impact

An attacker gains arbitrary OS command execution on the camera, enabling full compromise of the device and any data or network access it holds.

Attack surface

Reached over the network via the camera's configuration interface; the CVSS vector requires high privileges (PR:H), but the description states that chaining with CVE-2024-8956 makes the attack remote and unauthenticated. No user interaction is required.

Exploitation

Listed in CISA KEV with a due date of 2024-11-25, and EPSS 30-day probability is 0.80964 (99.6th percentile). A reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade PT30X-SDI/NDI-xx cameras to firmware 6.3.40 or later.
• If patching is not possible, remove affected cameras from untrusted networks or discontinue use per CISA guidance.
• Restrict management and NTP-related configuration access to trusted administrative networks.
• Segment cameras from production networks and block inbound access from the internet.
• Monitor for exploitation attempts against the chained CVE-2024-8956 entry point.

Detection

• Alert on unexpected outbound connections or command-and-control traffic from camera IP addresses.
• Monitor camera configuration changes to ntp_addr and related NTP settings.
• Watch for unusual processes or shell activity on camera hosts where telemetry is available.
• Correlate camera network traffic with known exploitation indicators from the referenced advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.