PatchTheCVECVE-2024-8957: PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability
CVE-2024-8957 is a high-severity flaw (CVSS 7.2) affecting pt30x-sdi firmware, pt30x-ndi-xx-g2 firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 79.8% (top 1%) |
| CISA exploited list | Yes, fix due 2024-11-25 |
| Weakness | CWE-78 |
| Published | 2024-09-17 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-8957?
pt30x-sdi firmware: upgrade to 6.3.40; pt30x-ndi-xx-g2 firmware: upgrade to 6.3.40. Exact commands for each OS are on this page.
Is CVE-2024-8957 being exploited?
Yes. CVE-2024-8957 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2024-8957 affect?
CVE-2024-8957 affects pt30x-sdi firmware, pt30x-ndi-xx-g2 firmware. Severity is high (CVSS 7.2). PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is st
How urgent is CVE-2024-8957?
Priority 80/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference
Related CVEs
- CVE-2024-8956 CRITICAL 9.1 EXPLOITED UPGRADE UPGRADE PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability