PatchTheCVECVE-2022-37109: patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorr
CVE-2022-37109 is a critical-severity flaw (CVSS 9.8) affecting camp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the pass
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 49.5% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-522 |
| Published | 2022-11-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: medium.com/@elias.hohl/authentication-bypass-vulnerability-in-camp-a-raspberry-pi-camera-s
- Exploit-DB: _camp_ Raspberry Pi camera server 1.0 - Authentication Bypass
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-37109?
camp: upgrade to 2022-07-21. Exact commands for each OS are on this page.
Is CVE-2022-37109 being exploited?
CVE-2022-37109 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-37109 affect?
CVE-2022-37109 affects camp. Severity is critical (CVSS 9.8). patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFile
How urgent is CVE-2022-37109?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action