CVE-2019-14699

CRITICAL

MicroDigital N-series <6400.0.8.5 - Command Injection

Title source: llm
STIX 2.1

Description

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename parameter for remote code execution as root. This occurs in the Mainproc executable file, which can be run from the HTTPD web server.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://www.microdigital.ru/
Vendor Advisory x_refsource_misc
http://www.microdigital.co.kr/
Third Party Advisory x_refsource_misc
https://pastebin.com/PSyqqs1g

Scores

CVSS v3 9.8
EPSS 0.0599
EPSS Percentile 92.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (3)
microdigital/mdc-n2190v_firmware < 6400.0.8.5
microdigital/mdc-n4090_firmware < 6400.0.8.5
microdigital/mdc-n4090w_firmware < 6400.0.8.5
Published Aug 06, 2019
Tracked Since Feb 18, 2026