CVE-2022-30620 Cellinx NVT – IP PTZ Camera Privilege Escalation
An attacker can escalate privileges to administrator by modifying specific cookie values in Cellinx IP PTZ Cameras with guest access enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-30620?
CVE-2022-30620 is a high-severity vulnerability in Cellinx NVT - IP PTZ Camera, published on 18 Jul 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the camera.
Weakness: CWE-565
Which versions are affected by CVE-2022-30620?
It affects 1 product.
Products include Cellinx Cellinx Nvt - Ip Ptz Camera Firmware.
How do I fix CVE-2022-30620?
No fix has been published for CVE-2022-30620 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30620 being exploited?
There is no known exploitation of CVE-2022-30620 in the wild and no public exploit code.
Other vulnerabilities in Cellinx NVT - IP PTZ Camera
Sources
Also known as GHSA-7mq3-jhxf-cfj7.