CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
Unauthenticated attackers can export unencrypted system configuration to retrieve administrator credentials in plain text from Advan VD-1 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11064?
CVE-2019-11064 is a critical vulnerability in AndroVideo Advan VD-1 firmware, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
Which versions are affected by CVE-2019-11064?
It affects 3 products.
Products include Androvideo Vd 1 Firmware, Geovision Gv-Vd8700 Firmware, Geovision Gv-Vr360 Firmware.
How do I fix CVE-2019-11064?
No fix has been published for CVE-2019-11064 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-11064 being exploited?
There is no known exploitation of CVE-2019-11064 in the wild and no public exploit code.
Other vulnerabilities in AndroVideo Advan VD-1 firmware
- CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
- CVE-2019-13406 Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
- CVE-2019-13408 Advan VD-1 allows users to download arbitrary files
- CVE-2019-13407 Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
Sources
Also known as GHSA-3q8h-2vx4-hg56.