CVE-2019-14702
📋 TL;DR
This CVE describes SQL injection vulnerabilities in 13 HTTPD forms on MicroDigital N-series cameras. Attackers can exploit these vulnerabilities to execute arbitrary SQL commands, potentially creating admin accounts or accessing sensitive data. All users of affected MicroDigital N-series cameras with vulnerable firmware are at risk.
💻 Affected Systems
- MicroDigital N-series cameras
📦 What is this software?
Mdc N2190v Firmware by Microdigital
Mdc N4090 Firmware by Microdigital
Mdc N4090w Firmware by Microdigital
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to create admin accounts, access all camera data, modify configurations, and potentially pivot to other network systems.
Likely Case
Unauthorized admin account creation leading to camera control, video feed access, and configuration changes.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
SQL injection in HTTP forms is trivial to exploit with basic web testing tools. Pastebin references suggest exploit details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.microdigital.co.kr/
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Upload via camera web interface. 4. Reboot camera.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN with no internet access
Web Application Firewall
allDeploy WAF with SQL injection rules in front of cameras
🧯 If You Can't Patch
- Block all external access to camera HTTPD ports (typically 80/443)
- Implement strict network ACLs allowing only trusted management IPs
🔍 How to Verify
Check if Vulnerable:
Check firmware version in camera web interface under System > InformationCheck Version:
curl -s http://camera-ip/systeminfo | grep FirmwareVerify Fix Applied:
Verify firmware version is above 6400.0.8.5 and test SQL injection payloads on login/configuration forms📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in HTTPD logs
- Multiple failed login attempts followed by successful admin creation
- Unusual SQL queries in database logs
Network Indicators:
- HTTP POST requests with SQL keywords (SELECT, UNION, INSERT) to camera forms
- Traffic to camera on non-standard ports
SIEM Query:
source="camera_logs" AND ("sql" OR "union" OR "select" OR "insert") AND status=200