What are the vulnerabilities discovered in PTZOptics cameras?

GreyNoise identified two zero-day vulnerabilities in PTZOptics cameras, affecting firmware versions earlier than 6.3.40: 1. CVE-2024-8956 (CVSS score 9.1) - Weak Authentication: This vulnerability allows unauthorized access to the camera’s CGI API without authentication, exposing usernames, password hashes, and network configurations. 2. CVE-2024-8957 (CVSS score 7.2) - Command Injection: Insufficient input validation in the ntp_client binary permits attackers to inject commands, potentially enabling remote code execution.

What impacts could these vulnerabilities have on PTZOptics cameras?

Exploiting these vulnerabilities could allow attackers to: 1. Gain full control of the camera, including unauthorized video access and manipulation. 2. Infect the device for use in botnets or to facilitate lateral movement within networks. 3. Disrupt or disable camera functionality, impacting security operations.

Which PTZOptics camera models are affected by these vulnerabilities?

The vulnerabilities impact VHD PTZ camera models across PTZOptics, Multicam Systems SAS, and SMTAV Corporation. Specific affected models include NDI-enabled cameras such as PTZOptics PT20X-NDI-G2 and PT12X-NDI-G2, which are end-of-life, and models like PT20X-SE-NDI-G3 and PT30X-SE-NDI-G3, which have not yet received patches.

How can users protect their PTZOptics cameras from these vulnerabilities?

To mitigate risk, users are advised to: 1. Isolate the cameras from internet access and restrict access to trusted network zones only. 2. Consider replacing end-of-life models that will not receive patches. 3. Monitor for firmware updates from PTZOptics for ongoing support of other affected models.

Are there patches available for these vulnerabilities?

As of now, no patches have been released for models like PT20X-SE-NDI-G3 and PT30X-SE-NDI-G3. End-of-life models, including PT20X-NDI-G2 and PT12X-NDI-G2, will not receive patches, and users of these devices are advised to isolate or replace them.

Attack

Hackers attempt to exploit zero-day flaws in PTZOptics cameras

published: Oct. 31, 2024

Take action: If you are using PTZOptics cameras, check if they are in the vulnerable device list. Make sure you isolate the cameras from internet access and make them accessible from trusted zones only. Plan to patch the devices which are under supporta and replace end-of-life models.

Learn More

GreyNoise has identified two zero-day vulnerabilities in PTZOptics pan-tilt-zoom (PTZ) cameras, tracked as CVE-2024-8956 and CVE-2024-8957. Attacks are detected by GreyNoise's threat detection tool, the flaws impact VHD PTZ camera firmware versions earlier than 6.3.40, affecting models across PTZOptics, Multicam Systems SAS, and SMTAV Corporation.

Details of the Vulnerabilities:

CVE-2024-8956 (CVSS score 9.1) - Weak Authentication in Web Server: A vulnerability in the embedded lighttpd web server allows unauthorized access to the camera’s CGI API without authentication, exposing usernames, password hashes, and network configurations.
CVE-2024-8957 (CVSS score 7.2) - Command Injection via ntp_client: Insufficient input validation in the ntp_client binary allows attackers to insert commands through the ntp.addr parameter, leading to potential remote code execution.

Exploiting these vulnerabilities could lead to:

Full camera control, including unauthorized video access and manipulation.
Infection of the device for use in botnets or lateral movement to other networked devices.
Disruption or disablement of camera functionality.

Affected models include NDI-enabled cameras like PTZOptics PT20X-NDI-G2 and PT12X-NDI-G2, which remain vulnerable due to end-of-life status, as well as PT20X-SE-NDI-G3 and PT30X-SE-NDI-G3, which have yet to receive patches.

Users are advised to isolate the cameras from internet access and make them accessible from trusted zones, as well as to replace end-of-life models.

Hackers attempt to exploit zero-day flaws in PTZOptics cameras

Read More
China related espionage group UNC3886 exploits end-of-life Juniper …
GeoServer flaw actively targeted by hackers, patch now
CISA reports active exploitation of Advantive VeraCore flaws
CISA confirms exploitation of two BeyondTrust flaws, urges …
Apple iOS and macOS vulnerability from 2022 actively …