CVE-2019-13408 - Advan VD-1 allows users to download arbitrary files

Back Back to CVE browser

HIGH

Advan VD-1 allows users to download arbitrary files

Published Aug 29, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.91%

Description

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.

Affected products

Vendor AndroVideo Product Advan VD-1 firmware Default
n/a
- Version
  up to 230
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

AndroVideo

Advan VD-1 firmware

n/a

Version	Status	Constraints
up to 230	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-22

Path Traversal

CWE-23

CWE-862

Missing Authorization

References (4)

http://surl.twcert.org.tw/2bvXq
x_refsource_CONFIRMThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4902
Advisory
https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md
x_refsource_CONFIRMExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906009
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
http://surl.twcert.org.tw/2bvXq		x_refsource_CONFIRMThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4902		Advisory
https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md		x_refsource_CONFIRMExploitThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201906009		x_refsource_CONFIRMThird Party Advisory