CVE-2019-13407 Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
Reflected XSS in Advan VD-1 firmware allows attackers to execute arbitrary scripts via unescaped error messages in the ssi.cgi page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13407?
CVE-2019-13407 is a medium-severity cross-site scripting vulnerability in AndroVideo Advan VD-1 firmware, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
Weakness: CWE-79
Which versions are affected by CVE-2019-13407?
It affects 3 products.
Products include Androvideo Vd 1 Firmware, Geovision Gv-Vd8700 Firmware, Geovision Gv-Vr360 Firmware.
How do I fix CVE-2019-13407?
No fix has been published for CVE-2019-13407 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-13407 being exploited?
There is no known exploitation of CVE-2019-13407 in the wild and no public exploit code.
Other vulnerabilities in AndroVideo Advan VD-1 firmware
- CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
- CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
- CVE-2019-13406 Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
- CVE-2019-13408 Advan VD-1 allows users to download arbitrary files
Sources
Also known as GHSA-452c-mgc8-crh5.