CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
Remote attackers can enable Android Debug Bridge without authentication on Advan VD-1 devices, allowing full device compromise and malicious software installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13405?
CVE-2019-13405 is a critical authentication bypass vulnerability in AndroVideo Advan VD-1 firmware, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
Weakness: CWE-306
Which versions are affected by CVE-2019-13405?
It affects 1 product.
Products include Androvideo Vd 1 Firmware.
How do I fix CVE-2019-13405?
No fix has been published for CVE-2019-13405 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-13405 being exploited?
There is no known exploitation of CVE-2019-13405 in the wild and no public exploit code.
Other vulnerabilities in AndroVideo Advan VD-1 firmware
- CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
- CVE-2019-13406 Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
- CVE-2019-13408 Advan VD-1 allows users to download arbitrary files
- CVE-2019-13407 Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
Sources
Also known as GHSA-qv2v-77pv-fhr9.