CRITICAL
A vulnerability of remote credential disclosure was discovered in Advan VD-1
Published Aug 29, 2019
9.8
CRITICALCVSS 3.1
EPSS 1.94%
Description
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
Affected products
-
- Version up to 230StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AndroVideo | Advan VD-1 firmware | n/a |
|
Configuration 1
AND
- ≤ 230
Running on/with
- n/a
Configuration 2
AND
- ≤ 1.10
Configuration 3
AND
- ≤ 1.01
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- http://surl.twcert.org.tw/gCDQN x_refsource_CONFIRMThird Party Advisory
- https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md x_refsource_CONFIRMExploitThird Party Advisory
- https://tvn.twcert.org.tw/taiwanvn/TVN-201906005 x_refsource_CONFIRMThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://surl.twcert.org.tw/gCDQN | x_refsource_CONFIRMThird Party Advisory | |
| https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md | x_refsource_CONFIRMExploitThird Party Advisory | |
| https://tvn.twcert.org.tw/taiwanvn/TVN-201906005 | x_refsource_CONFIRMThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner twcert
Published Aug 29, 2019
Updated Sep 17, 2024
Reserved Apr 9, 2019
Link CVE-2019-11064
CISA Vulnrichment
Updated n/a