vd_1_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vd_1_firmware/ Sun, 26 Feb 2023 06:30:15 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png vd_1_firmware Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vd_1_firmware/ 32 32 CVE-2019-13405 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13405/ Sun, 26 Feb 2023 06:30:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13405/ A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.

The post CVE-2019-13405 appeared first on CVE Vulnerability.

]]> A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.

The post CVE-2019-13405 appeared first on CVE Vulnerability.

]]> CVE-2019-13406 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13406/ Sun, 26 Feb 2023 06:30:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13406/ A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.

The post CVE-2019-13406 appeared first on CVE Vulnerability.

]]> A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.

The post CVE-2019-13406 appeared first on CVE Vulnerability.

]]> CVE-2019-13407 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13407/ Sun, 26 Feb 2023 06:30:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13407/ A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.

The post CVE-2019-13407 appeared first on CVE Vulnerability.

]]> A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.

The post CVE-2019-13407 appeared first on CVE Vulnerability.

]]> CVE-2019-13408 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13408/ Sun, 26 Feb 2023 06:30:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13408/ A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.

The post CVE-2019-13408 appeared first on CVE Vulnerability.

]]> A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.

The post CVE-2019-13408 appeared first on CVE Vulnerability.

]]> CVE-2019-11064 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-11064/ Sun, 26 Feb 2023 06:29:24 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-11064/ A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.

The post CVE-2019-11064 appeared first on CVE Vulnerability.

]]> A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.

The post CVE-2019-11064 appeared first on CVE Vulnerability.

]]>