CVE-2022-30620

Published: Jul 18, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the camera.

Affected (2)

Products: Cellinx: Cellinx Nvt Ip Ptz Camera Firmware

1 product

Cellinx Nvt Ip Ptz Camera Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cellinx Cellinx Nvt Ip Ptz Camera Firmware	Version 3.2.0
Cellinx Cellinx Nvt Ip Ptz Camera Firmware	Version 3.2.1

Running on/with	Platform Versions
Cellinx Cellinx Nvt Ip Ptz Camera	All versions

Related CWEs

Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (2)

https://www.gov.il/en/departments/faq/cve_advisories

Source: cna@cyber.gov.il

Third Party Advisory

https://www.gov.il/en/departments/faq/cve_advisories

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.