CVE-2019-14702

EUVD-2019-5852
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
microdigitalmdc-n4090_firmware
𝑥
≤ 6400.0.8.5
microdigitalmdc-n4090w_firmware
𝑥
≤ 6400.0.8.5
microdigitalmdc-n2190v_firmware
𝑥
≤ 6400.0.8.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.microdigital.co.kr/
https://pastebin.com/PSyqqs1g
https://www.microdigital.ru/
http://www.microdigital.co.kr/
https://pastebin.com/PSyqqs1g
https://www.microdigital.ru/