VULNERA Pulse

PTZOptics — PT30X-SDI/NDI Cameras

CVE-2024-8957 / Added: Nov. 4, 2024

CRITICAL CVSS 9.80 EPSS Score 1.10 EPSS Percentile 84.93

PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.

Headlines

• Nov. 5, 2024 - U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog
• Nov. 4, 2024 - CVE-2024-8956 & CVE-2024-8957: Two Actively Exploited Vulnerabilities in PTZ Cameras
• Nov. 2, 2024 - PTZOptics cameras zero-days actively exploited in the wild
• Oct. 31, 2024 - Hackers target critical zero-day vulnerability in PTZ cameras

Back to top ↑

PTZOptics — PT30X-SDI/NDI Cameras

CVE-2024-8956 / Added: Nov. 4, 2024

CRITICAL CVSS 9.10 EPSS Score 1.97 EPSS Percentile 89.12

PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.

Headlines

• Nov. 5, 2024 - U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog
• Nov. 4, 2024 - CVE-2024-8956 & CVE-2024-8957: Two Actively Exploited Vulnerabilities in PTZ Cameras
• Nov. 2, 2024 - PTZOptics cameras zero-days actively exploited in the wild
• Oct. 31, 2024 - Hackers target critical zero-day vulnerability in PTZ cameras
• Sept. 24, 2024 - CVE-2024-8956 (CVSS 9.1): PTZOptics Cameras Vulnerable to Remote Attacks

Back to top ↑

CVE-2024-20418

CRITICAL CVSS 10.00

Actively Exploited

Published: Nov. 6, 2024

A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated, remote attacker to perform command injection attacks with root privileges on the underlying operating system. This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device.

Quotes

• Improper validation of input to the web-based management interface
• This vulnerability is due to improper validation of input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system

Headlines

• Nov. 6, 2024 - Cisco bug lets hackers run commands as root on UWRB access points
• Nov. 6, 2024 - CVE-2024-20418 (CVSS 10): Cisco URWB Access Points Vulnerable to Remote Takeover

CVE-2024-10386

CRITICAL CVSS 9.80 EPSS Score 0.07 EPSS Percentile 32.58

Risk Context N/A

Published: Oct. 25, 2024

CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation.

Vendor Impacted: Rockwellautomation

Product Impacted: Thinmanager

Quotes

• Customers using the affected software are encouraged to apply these risk mitigations

Headlines

• Nov. 5, 2024 - Critical Vulnerabilities Found in Rockwell Automation FactoryTalk ThinManager
• Nov. 4, 2024 - THN Recap: Top Cybersecurity Threats, Tools, and Practices (Oct 28 - Nov 03)

CVE-2024-8957

CRITICAL CVSS 9.80 EPSS Score 1.10 EPSS Percentile 84.93

CISA Known Exploited

Published: Sept. 17, 2024

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.

Vendor Impacted: Ptzoptics

Products Impacted: Pt30x-Sdi, Pt30x-Sdi Firmware, Pt30x-Ndi-Xx-G2 Firmware, Pt30x-Sdi/ndi Cameras, Pt30x-Ndi-Xx-G2

Quotes

• Upon accessing the device with omitted Authorization header, CGI API does not return 401 Unauthorized, and exposes the sensitive information about the camera
• The vulnerabilities impact NDI-enabled pan-tilt-zoom (PTZ) cameras from multiple manufacturers. Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63

Headlines

• Nov. 5, 2024 - U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog
• Nov. 4, 2024 - CVE-2024-8956 & CVE-2024-8957: Two Actively Exploited Vulnerabilities in PTZ Cameras

CVE-2022-1040

CRITICAL CVSS 9.80 EPSS Score 97.46 EPSS Percentile 99.97

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: March 25, 2022

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

Vendor Impacted: Sophos

Products Impacted: Firewall, Sfos

Quotes

• X-Ops identified two copies of libsophos.so, both deployed using CVE-2022-1040 — one on a high-level government device and the other on a technology partner to the same government department

Headlines

• Nov. 5, 2024 - FBI Seeks Public Help to Identify Chinese Hackers Behind Global Cyber Intrusions
• Nov. 4, 2024 - Custom "Pygmy Goat" malware used in Sophos Firewall hack on govt network

CVE-2024-8956

CRITICAL CVSS 9.10 EPSS Score 1.97 EPSS Percentile 89.12

CISA Known Exploited Remote Code Execution

Published: Sept. 17, 2024

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Vendor Impacted: Ptzoptics

Products Impacted: Pt30x-Sdi, Pt30x-Sdi Firmware, Pt30x-Ndi-Xx-G2 Firmware, Pt30x-Sdi/ndi Cameras, Pt30x-Ndi-Xx-G2

Quotes

• Upon accessing the device with omitted Authorization header, CGI API does not return 401 Unauthorized, and exposes the sensitive information about the camera
• The vulnerabilities impact NDI-enabled pan-tilt-zoom (PTZ) cameras from multiple manufacturers. Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63

Headlines

• Nov. 5, 2024 - U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog
• Nov. 4, 2024 - CVE-2024-8956 & CVE-2024-8957: Two Actively Exploited Vulnerabilities in PTZ Cameras

CVE-2024-43047

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 29.28

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Oct. 7, 2024

Memory corruption while maintaining memory maps of HLOS memory.

Vendor Impacted: Qualcomm

Products Impacted: Sd660 Firmware, Sa6155p, Fastconnect 6900 Firmware, Snapdragon 660 Mobile Firmware, Qca6595au Firmware, Wcn3988, Snapdragon 888 5g Mobile Firmware, Sa8195p Firmware, Sa8295p, Qcs410 Firmware, Snapdragon Auto 5g Modem-Rf Firmware, Snapdragon 680 4g Mobile, Snapdragon 870 5g Mobile Firmware, Snapdragon Auto 5g Modem-Rf, Wcd9380, Sg4150p Firmware, Snapdragon 680 4g Mobile Firmware, Sa8150p, Sa6155p Firmware, Wsa8830 Firmware, Sa8155p, Sa8155p Firmware, Wsa8810, Qca6436 Firmware, Qca6696, Wcn3988 Firmware, Sd865 5g, Qca6174a Firmware, Wcn3980, Video Collaboration Vc1, Qca6696 Firmware, Snapdragon Xr2 5g Firmware, Wcn3980 Firmware, Qca6574au Firmware, Snapdragon 8 Gen 1 Mobile Firmware, Sa6150p Firmware, Fastconnect 6900, Sd865 5g Firmware, Wsa8835 Firmware, Snapdragon 8 Gen 1 Mobile, Snapdragon 870 5g Mobile, Wcd9341, Wcd9341 Firmware, Qca6174a, Wcd9335 Firmware, Wcd9335, Wcd9370, Qca6584au, Wcn3990 Firmware, Sa6145p Firmware, Fastconnect 6800, Snapdragon 865\+ 5g Mobile Firmware, Snapdragon 888\+ 5g Mobile...

Quotes

• May be under limited, targeted exploitation
• Remote access capabilities allow threat actors to conduct account takeover (ATO) directly from the infected device, thus exploiting the on-device Fraud (ODF) technique
• There are indications that the following may be under limited, targeted exploitation. The vulnerability CVE-2024-43047 is a kernel issue in the Qualcomm components. The issue is a potential use-after-free (UAF) vulnerability in the way the DSP (Digital Signal Processor) handles Direct Memory Access (DMA) file descriptors (FDs) in its header buffers. Successful exploitation can lead to memory corruption. Both vulnerabilities are under limited, targeted exploitation, Google states. In September, Google addressed a high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), in its Android operating system under active exploitation in the wild. The vulnerability CVE-2024-32896 is a privilege escalation in the Android Framework component

Headlines

• Nov. 5, 2024 - Android Botnet ToxicPanda Bashes Banks Across Europe, LatAm
• Nov. 5, 2024 - Google fixes two Android zero-days used in targeted attacks
• Nov. 5, 2024 - Google patches actively exploited Android vulnerability (CVE-2024-43093)
• Nov. 5, 2024 - Android flaw may be under limited, targeted exploitation
• Nov. 5, 2024 - Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System
• Nov. 5, 2024 - CVE-2024-43047 & CVE-2024-43093: Android Zero-Days Demand Immediate Patching

CVE-2024-32896

HIGH CVSS 7.80 EPSS Score 0.08 EPSS Percentile 36.42

CISA Known Exploited Actively Exploited Remote Code Execution

Published: June 13, 2024

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Vendors Impacted: Android, Google

Products Impacted: Android, Pixel

Quotes

• May be under limited, targeted exploitation
• There are indications that the following may be under limited, targeted exploitation. The vulnerability CVE-2024-43047 is a kernel issue in the Qualcomm components. The issue is a potential use-after-free (UAF) vulnerability in the way the DSP (Digital Signal Processor) handles Direct Memory Access (DMA) file descriptors (FDs) in its header buffers. Successful exploitation can lead to memory corruption. Both vulnerabilities are under limited, targeted exploitation, Google states. In September, Google addressed a high-severity vulnerability, tracked as CVE-2024-32896 (CVSS score: 7.8), in its Android operating system under active exploitation in the wild. The vulnerability CVE-2024-32896 is a privilege escalation in the Android Framework component

Headlines

• Nov. 5, 2024 - Android flaw may be under limited, targeted exploitation
• Nov. 5, 2024 - Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System

CVE-2020-14979

HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 5.12

Risk Context N/A

Published: Aug. 11, 2020

The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\SYSTEM privileges by mapping \Device\PhysicalMemory into the calling process.

Vendors Impacted: Evga, Winring0 Project

Products Impacted: Winring0, Precision X1

Quotes

• Bring your own vulnerable driver

Headlines

• Nov. 6, 2024 - New SteelFox malware hijacks Windows PCs using vulnerable driver
• Nov. 6, 2024 - SteelFox Trojan imitates popular products to drop stealer and miner malware