Veille CVE

Recherche « ptzoptics pt30x-sdi_firmware »

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « ptzoptics pt30x-sdi_firmware » ✕
  1. CVE-2024-8957 7.2 Élevée Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

  2. CVE-2024-8956 9.1 Critique Exploitée

    PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi-xx-g2_firmware

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.