CVE-2019-13405: Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13405?
CVE-2019-13405 is classified as a high severity vulnerability due to broken access controls allowing unauthenticated access to critical system functions.
How do I fix CVE-2019-13405?
To fix CVE-2019-13405, it is recommended to update the Advan VD-1 firmware to a version that addresses the broken access control issues.
What are the implications of CVE-2019-13405?
CVE-2019-13405 allows attackers to enable ADB on the device without authentication, potentially leading to unauthorized access and control.
Which devices are affected by CVE-2019-13405?
Devices running Advan VD-1 firmware version 230 are affected by CVE-2019-13405.
Can CVE-2019-13405 lead to remote code execution?
Yes, CVE-2019-13405 can enable an attacker to exploit the device for various malicious activities including remote code execution.