CVE-2019-13408 Advan VD-1 allows users to download arbitrary files
Unauthenticated attackers can download arbitrary files from Advan VD-1 devices via a relative path traversal vulnerability in the ExportSettings.cgi endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13408?
CVE-2019-13408 is a high-severity path traversal vulnerability in AndroVideo Advan VD-1 firmware, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.
Which versions are affected by CVE-2019-13408?
It affects 3 products.
Products include Androvideo Vd 1 Firmware, Geovision Gv-Vd8700 Firmware, Geovision Gv-Vr360 Firmware.
How do I fix CVE-2019-13408?
No fix has been published for CVE-2019-13408 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-13408 being exploited?
There is no known exploitation of CVE-2019-13408 in the wild and no public exploit code.
Other vulnerabilities in AndroVideo Advan VD-1 firmware
- CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
- CVE-2019-13405 Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
- CVE-2019-13406 Advan VD-1 has a vulnerability that allows remote arbitrary APK installation
- CVE-2019-13407 Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
Sources
Also known as GHSA-fwx2-7cx7-p6j5.