CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication

2019-08-2000:00:00

twcert

www.cve.org

9.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.7%

JSON

A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.

CNA Affected

[
  {
    "product": "Advan VD-1 firmware",
    "vendor": "AndroVideo",
    "versions": [
      {
        "status": "affected",
        "version": "230"
      }
    ]
  }
]