CISA Announced Critical Security Flaws in PTZOptics Cameras

• CISA identified two critical vulnerabilities in PTZOptics cameras with older firmware.
• These allow OS command injection and authentication bypass, posing a significant risk, especially to federal agencies and enterprises.
• Attackers could gain control over IoT devices and steal sensitive information from the compromised networks.

An urgent alert regarding two critical vulnerabilities in PTZOptics PT30X-SDI/NDI cameras was issued. These allow potential control over cameras, authentication bypass, data exfiltration, or even remote device configuration altering, which could lead to unauthorized access to video feeds and possible data breaches for enterprises.

The Cybersecurity and Infrastructure Security Agency (CISA) has added the two flaws, identified as CVE-2024-8957 and CVE-2024-8956, to its Known Exploited Vulnerabilities (KEV) Catalog.

CVE-2024-8957 affects PTZOptics cameras running firmware versions older than 6.3.40. It allows remote, authenticated attackers to escalate their privileges to root by injecting crafted payloads into the `ntp_addr` parameter of the `/cgi-bin/param.cgi` script. 

During the `ntp_client` startup, the unauthorized command can be executed, providing the attacker with complete control over the device. The vulnerability is classified under CWE-78 for OS Command Injection.

CVE-2024-8956 is characterized by an insecure direct object reference (IDOR) vulnerability, allowing attackers to bypass authentication controls within the `/cgi-bin/param.cgi` script. 

This flaw impacts PTZOptics cameras running firmware versions before 6.3.40, enabling unauthorized access to sensitive functions and data without proper credentials. It is listed under CWE-287 for Improper Authentication.

These vulnerabilities underline the security challenges Internet of Things (IoT) devices face, including surveillance cameras such as PTZOptics cameras, which have access to sensitive data and limited built-in security measures.

CISA strongly advises users to upgrade their devices to firmware version 6.3.40 to mitigate these vulnerabilities. If updating is not feasible, users should discontinue the use of these vulnerable devices to prevent potential unauthorized access and data compromise. The deadline for remediation actions is set for November 25, 2024.

The most recent CISA warning concerns an unpatched vulnerability that affects ScienceLogic SL1, formerly known as EM7, potentially allowing remote code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog after discovering active zero-day exploitation.

Related

Patched FortiClient EMS Vulnerability Exploited in the Wild Worldwide

Rapido Ride-Hailing Platform Leaks User and Driver Data via Website Flaw

GPS Tracker Company ‘Hapn’ Exposes Thousands of Customers' Identities Due to Website Flaw

Clipper DEX Exploit Targets Withdrawal Functionality, Resulting in $450K Loss

Critical ICS Flaws Seen in Schneider Electric, mySCADA, and Automated Logic Products  

Zyxel Firewalls Vulnerability Targeted by Helldown Ransomware

Most Popular

Attack on Titan: The Last Attack- all the Confirmed International Theatrical Release Dates

Den of Thieves 2: Pantera- All we know About the sequel to the Surprise hit Heist film

Does Sonic 3 have a Post-Credits Scene?

What we know so far About Virgin River Season 7

Colleen Hoover’s Verity Movie Adaptation adds two more Hollywood Stars to its cast

Stranger Things Season 5 Release date: One good news and one bad news for fans