CVE-2019-13406

CVE-2019-13406 refers to a broken access control vulnerability in Advan VD-1 firmware up to version 230. An unauthenticated attacker can POST to cgibin/ApkUpload.cgi and install arbitrary APKs. The issue is validated across multiple sources in the Connected documents (NVD/NVD-derived entries and ...

CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication

A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software...

CVE-2019-13405

CVE-2019-13405 affects AndroVideo Advan VD-1 firmware v230. The issue is broken access control allowing an unauthenticated POST to cgibin/AdbSetting.cgi to enable ADB, enabling the attacker to take control of the device as a relay or install mining software. The public docs do not provide a patch...

CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1

A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...

CVE-2019-11064

The CVE-2019-11064 issue affects Advan VD-1 firmware (up to v230). It enables remote credential disclosure: an attacker can export the unencrypted system configuration via cgibin/ExportSettings.cgi?Export=1 without authentication, exposing administrator account and password in plain text. This is...

CVE-2019-13408

CVE-2019-13408 describes a relative path traversal vulnerability in Advan VD-1 firmware up to version 230, allowing unauthenticated download of arbitrary files via cgibin/ExportSettings.cgi?Download=filepath. Exploitation details and affected products in connected sources include GeoVision/OT plu...

CVE-2019-13408 Advan VD-1 allows users to download arbitrary files

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication...

AndroVideo Advan VD-1 Access Control Error Vulnerability

The AndroVideo Advan VD-1 is a security camera from AndroVideo Taiwan, China. An access control error vulnerability exists in AndroVideo Advan VD-1. The vulnerability can be exploited to install arbitrary APKs without authentication by sending a POST request to the cgibin/ApkUpload.cgi file...

AndroVideo Advan VD-1 Trust Management Issues Vulnerability

The AndroVideo Advan VD-1 is a security camera from AndroVideo Taiwan, China. The AndroVideo Advan VD-1 is vulnerable to a trust management issue. The vulnerability can be exploited by an attacker to attack affected components using default passwords or hard-coded passwords, hard-coded...

CVE-2019-13408: Relative Path Traversal

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication...

CVE-2019-13406: Missing Authentication for Critical Function

A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication...

CVE-2019-13407: Improper Neutralization of Input During Web Page Generation

A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly...

CVE-2019-11064: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...

PT-2019-13320

Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware versions up to 230 Description A relative path traversal issue allows attackers to download arbitrary files without authentication via the API endpoint "/cgi-bin/ExportSettings.cgi" with the Download parameter set to...

PT-2019-13319

Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware versions up to 230 Description A cross-site scripting XSS issue is present due to improper escaping of error messages. When a requested resource is not found in the page cgibin/ssi.cgi, the VD-1 responds with a path error...

CVE-2019-13405: Missing Authentication for Critical Function

A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software...

PT-2019-13317

Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware version 230 Description A broken access control issue allows an attacker to send a POST request to "cgibin/AdbSetting.cgi" and enable ADB without authentication, potentially leading to the device being used as a relay or fo...

PT-2019-13318

Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware versions up to 230 Description A broken access control issue allows an attacker to install arbitrary APKs without authentication by sending a POST request to "cgibin/ApkUpload.cgi". Recommendations For Advan VD-1 firmware...

AndroVideo Advan VD-1 Path Traversal Vulnerability

The AndroVideo Advan VD-1 is a security camera from AndroVideo Taiwan, China. A path traversal vulnerability exists in AndroVideo Advan VD-1. An attacker can exploit this vulnerability to access locations outside of a restricted directory...

PT-2019-12161

Name of the Vulnerable Software and Affected Versions Advan VD-1 firmware versions up to 230 Description A remote credential disclosure issue was found, allowing an attacker to export system configuration without encryption, thereby accessing the administrator's account and password in plain text...