CVE-2019-14704
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in MicroDigital N-series camera firmware. Attackers can exploit it by injecting FTP commands via the uploadfile field to make the HTTPD server send unauthorized requests to internal systems. This affects all MicroDigital N-series cameras running firmware versions up to 6400.0.8.5.
💻 Affected Systems
- MicroDigital N-series cameras
📦 What is this software?
Mdc N2190v Firmware by Microdigital
Mdc N4090 Firmware by Microdigital
Mdc N4090w Firmware by Microdigital
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to pivot to internal networks, exfiltrate sensitive data, or use the camera as a proxy for attacks against other internal systems.
Likely Case
Unauthorized access to internal services, information disclosure from internal systems, and potential use as an attack proxy.
If Mitigated
Limited impact if network segmentation prevents the camera from accessing sensitive internal systems.
🎯 Exploit Status
Exploit details are publicly available on Pastebin. The vulnerability is straightforward to exploit with basic HTTP manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.microdigital.co.kr/
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Upload to camera via web interface. 4. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras in separate VLAN with restricted outbound access
Disable HTTPD Service
linuxTurn off the vulnerable HTTPD service if camera management isn't needed
killall httpd
rm /etc/init.d/httpd
🧯 If You Can't Patch
- Implement strict network ACLs to prevent cameras from accessing internal systems
- Deploy web application firewall rules to block SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH. If version is 6400.0.8.5 or earlier, system is vulnerable.Check Version:
cat /etc/version or check web interface system infoVerify Fix Applied:
Verify firmware version is above 6400.0.8.5. Test SSRF payloads should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual FTP connection attempts from camera IP
- HTTP requests to internal IPs from camera
Network Indicators:
- Camera making unexpected outbound connections
- FTP traffic from camera to internal systems
SIEM Query:
source_ip="camera_ip" AND (dest_port=21 OR dest_ip="internal_range")