First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-14700

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Traversal in HTTPD. This occurs because the filename specified in the TZ parameter is accessed with a substantial delay if that file exists.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.microdigital.co.kr/Vendor Advisory
https://pastebin.com/PSyqqs1gThird Party Advisory
https://www.microdigital.ru/Vendor Advisory
http://www.microdigital.co.kr/Vendor Advisory
https://pastebin.com/PSyqqs1gThird Party Advisory
https://www.microdigital.ru/Vendor Advisory

Timeline

Published: Aug 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-147017.5An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arb CVE-2019-147029.8An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms t CVE-2019-147038.8A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 CVE-2019-147049.8An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline CVE-2019-147057.2An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie CVE-2019-147067.5A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without aut CVE-2019-147077.2An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading CVE-2019-147089.8An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads t CVE-2019-147099.8A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is CVE-2019-14718.2A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us CVE-2019-147117.0Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.CVE-2019-147127.8Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation.