Description
PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| PT30X-NDI | PTZOptics / PT30X-NDI | >= 0, < 6.3.40 | affected |
| pt30x-ndi_firmware | ptzoptics / pt30x-ndi_firmware | >= 0, < 6.3.40 | affected |
| PT30X-SDI | PTZOptics / PT30X-SDI | >= 0, < 6.3.40 | affected |
| pt30x-sdi_firmware | ptzoptics / pt30x-sdi_firmware | >= 0, < 6.3.40 | affected |