Active Exploitation Targets PTZOptics Camera Authentication and RCE Flaws

FortiGuard Labs observed active attack attempts against PTZOptics cameras exploiting CVE-2024-8956 and CVE-2024-8957, vulnerabilities also documented in GreyNoise research. The flaws affect PT30X-SDI and PT30X-NDI cameras running firmware earlier than 6.3.40. FortiGuard's sensor telemetry involved as many as 4,000 devices, but that figure does not establish that all were compromised. CISA added both flaws to its Known Exploited Vulnerabilities catalog on November 4, 2024.

CVE-2024-8956, rated CVSS 9.1, allows unauthenticated remote attackers to access /cgi-bin/param.cgi by omitting the HTTP Authorization header, exposing usernames, password hashes, and configuration details. Attackers can also modify individual settings or overwrite the entire configuration file. CVE-2024-8957 enables remote code execution. Exploitation could lead to camera takeover, bot infection, lateral movement, or disrupted video feeds. Organizations operating affected cameras should prioritize vendor firmware updates to version 6.3.40 or later and review camera exposure and network segmentation.