Description
PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| PT30X-NDI | PTZOptics / PT30X-NDI | >= 0, < 6.3.40 | affected |
| pt30x-ndi-xx-g2_firmware | ptzoptics / pt30x-ndi-xx-g2_firmware | >= 0, < 6.3.40 | affected |
| PT30X-SDI | PTZOptics / PT30X-SDI | >= 0, < 6.3.40 | affected |
| pt30x-sdi_firmware | ptzoptics / pt30x-sdi_firmware | >= 0, < 6.3.40 | affected |