CVE-2019-14702

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.microdigital.co.kr/Vendor Advisory
https://pastebin.com/PSyqqs1gThird Party Advisory
https://www.microdigital.ru/Vendor Advisory
http://www.microdigital.co.kr/Vendor Advisory
https://pastebin.com/PSyqqs1gThird Party Advisory
https://www.microdigital.ru/Vendor Advisory

Timeline

Published: Aug 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-147038.8A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 CVE-2019-147049.8An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline CVE-2019-147057.2An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie CVE-2019-147067.5A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without aut CVE-2019-147077.2An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading CVE-2019-147089.8An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads t CVE-2019-147099.8A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is CVE-2019-14718.2A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us CVE-2019-147117.0Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.CVE-2019-147127.8Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation.CVE-2019-147135.5Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.CVE-2019-147156.8Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.