Design/Logic Flaw

2022-07-1813:15:00

PRIOn knowledge base

www.prio-n.com

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: “1” to “0” privileges by changing the following cookie values from “is_admin”, “showConfig”. Administrative Privileges which allows changing various configuration in the camera.

CPENameOperatorVersion
cellinx_nvt_-_ip_ptz_camera_firmwareeq3.2.0
cellinx_nvt_-_ip_ptz_camera_firmwareeq3.2.1

CPE	Name	Operator	Version
	cellinx_nvt_-_ip_ptz_camera_firmware	eq	3.2.0
	cellinx_nvt_-_ip_ptz_camera_firmware	eq	3.2.1

References

www.gov.il/en/departments/faq/cve_advisories