CVE-2019-11064

The CVE-2019-11064 issue affects Advan VD-1 firmware (up to v230). It enables remote credential disclosure: an attacker can export the unencrypted system configuration via cgibin/ExportSettings.cgi?Export=1 without authentication, exposing administrator account and password in plain text. This is...

CVE-2019-13406

CVE-2019-13406 refers to a broken access control vulnerability in Advan VD-1 firmware up to version 230. An unauthenticated attacker can POST to cgibin/ApkUpload.cgi and install arbitrary APKs. The issue is validated across multiple sources in the Connected documents (NVD/NVD-derived entries and ...

CVE-2019-13407

CVE-2019-13407 affects Advan VD-1 firmware versions up to 230. The issue arises in cgibin/ssi.cgi where a resource-not-found error message is not properly escaped, causing a reflected cross-site scripting (XSS) vulnerability. Impact is user-injected script execution in the context of the device’s...

CVE-2019-13405

CVE-2019-13405 affects AndroVideo Advan VD-1 firmware v230. The issue is broken access control allowing an unauthenticated POST to cgibin/AdbSetting.cgi to enable ADB, enabling the attacker to take control of the device as a relay or install mining software. The public docs do not provide a patch...

CVE-2019-13408

CVE-2019-13408 describes a relative path traversal vulnerability in Advan VD-1 firmware up to version 230, allowing unauthenticated download of arbitrary files via cgibin/ExportSettings.cgi?Download=filepath. Exploitation details and affected products in connected sources include GeoVision/OT plu...