CVE-2019-14703

A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account...

CVE-2019-14704

An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the uploadfile field...

CVE-2019-14704

CVE-2019-14704 describes an SSRF vulnerability in the HTTPD component of MicroDigital N-series cameras (firmware up to 6400.0.8.5). The issue occurs when FTP uploadfile field data contains a newline character, allowing HTTPD to be triggered via crafted FTP commands. Reported impact is high: CVSS ...

CVE-2019-14705

An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make requests as an admin...

CVE-2019-14705

CVE-2019-14705 affects MicroDigital N-series cameras up to firmware 6400.0.8.5. The issue is an incorrect access control that lets an attacker perform admin actions using any valid cookie, effectively bypassing authentication. Documented CVSSv3 base score is 7.2 (HIGH) with network attack vector ...

CVE-2019-14706

The CVE-2019-14706 entry concerns MicroDigital N-series IP cameras running firmware up to 6400.0.8.5. The vulnerability is a denial-of-service caused by an unauthenticated attacker uploading a file to upload.php with a filename longer than 256 bytes; the file is placed in the updownload area and ...

CVE-2019-14706

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14707

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI...

CVE-2019-14707

CVE-2019-14707 affects MicroDigital N-series cameras (firmware up to 6400.0.8.5). The issue is in the firmware update process, which is insecure and permits remote code execution when an attacker supplies arbitrary firmware in a .dat file via the URI webparam?system&action=set&upgrade. The availa...

CVE-2019-14708

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execution in the context of the nobody account...

CVE-2019-14708

CVE-2019-14708 affects MicroDigital N-series cameras up to firmware 6400.0.8.5. The issue is a buffer overflow in the action parameter, which can lead to remote code execution in the context of the nobody account. The available connected documents confirm the vulnerability description but do not ...

CVE-2019-14709

CVE-2019-14709 affects MicroDigital N-series cameras up to firmware 6400.0.8.5. The vulnerability is a cleartext password storage issue in the file "/usr/local/ipsca/mipsca.db". If a camera is compromised, an attacker can access passwords and potentially abuse them to compromise additional system...

CVE-2019-14709

A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...

CVE-2019-14700: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Traversal in HTTPD. This occurs because the filename specified in the TZ parameter is accessed with a substantial delay if that file exists...

CVE-2019-14701: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Path Traversal in the TZ parameter, but cannot retrieve the data that is read. This causes a denial of service if the filename is, for exampl...

CVE-2019-14702: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin account...

CVE-2019-14703: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account...

CVE-2019-14706: Improper Restriction of Operations within the Bounds of a Memory Buffer

A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can upload a file to upload.php with a filename longer than 256 bytes. This will be placed in the updownload area. It will not be deleted, because...

CVE-2019-14709: Insufficiently Protected Credentials

A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...

PT-2019-13801

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras versions through 6400.0.8.5 Description A cleartext password storage issue was discovered, allowing an attacker to gain access to passwords stored in the /usr/local/ipsca/mipsca.db file if a camera is compromised...