PT-2019-13792 · Apache+1 · Httpd+1

Shaposhnikov Ilya · Publicado 2019-08-06 · Atualizado 2019-08-13 · CVE-2019-14699

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras versions through 6400.0.8.5

Description The issue allows an attacker to exploit OS Command Injection in the filename parameter for remote code execution as root. This occurs in the Mainproc executable file, which can be run from the HTTPD web server.

Recommendations For versions through 6400.0.8.5, as a temporary workaround, consider restricting access to the Mainproc executable file to minimize the risk of exploitation. Avoid using the filename parameter in the affected HTTPD web server endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-14699

Produtos afetados

Httpd

Microdigital N-Series

Referências · 5

• http://microdigital.co.kr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14699 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14699 · Nota de Segurança
• https://pastebin.com/PSyqqs1g · Nota
• https://microdigital.ru · Aviso do Fabricante