Threat intelligence researchers at GreyNoise disclosed active in-the-wild exploitation of a critical zero-day exploit chain impacting PTZOptics pan-tilt-zoom (PTZ) live-streaming cameras running firmware prior to version 6.3.40. The attack sequence chains CVE-2024-8956 (CVSS 9.1), an authentication bypass in the embedded lighttpd web server, with CVE-2024-8957 (CVSS 7.2), an OS command injection flaw. CVE-2024-8956 occurs because /cgi-bin/param.cgi fails to enforce access validation when an HTTP Authorization header is absent, allowing unauthenticated attackers to retrieve administrative configurations and MD5 password hashes.

Armed with unauthenticated API access, threat actors exploit CVE-2024-8957 by injecting shell commands into the unsanitized ntp_addr configuration parameter processed by the ntp_client binary, executing arbitrary payloads with root privileges. GreyNoise honeypots detected automated botnet probes scanning internet-exposed cameras across healthcare, government, and enterprise facilities to achieve persistent device compromise and internal network pivoting. In response, PTZOptics released patched firmware version 6.3.40, while VulnCheck coordinated disclosure and provided detection rules.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Chaining header-omission authentication bypass with unescaped NTP client parameters delivers unauthenticated root execution, allowing attackers to hijack video feeds, install persistent botnet implants, and bypass perimeter ingress controls on internal audiovisual subnets.
• Bullet 2 — Strategic & Defender Imperative: Administrators must flash camera firmware to version 6.3.40 immediately, remove all PTZ streaming devices from public routing, and isolate camera management interfaces onto dedicated, non-routable VLANs with strict outbound egress filtering.