CVE-2019-13407: Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13407?
CVE-2019-13407 is classified as a high-severity vulnerability due to its ability to allow reflected cross-site scripting (XSS).
How do I fix CVE-2019-13407?
To fix CVE-2019-13407, update the affected Advan VD-1 firmware to a version that exceeds 230, ensuring proper input sanitization.
What systems are affected by CVE-2019-13407?
CVE-2019-13407 affects Advan VD-1 firmware versions up to 230 and specific firmware versions of Geovision products.
How does CVE-2019-13407 exploit XSS vulnerabilities?
CVE-2019-13407 exploits XSS by returning a path error message from the cgibin/ssi.cgi resource without proper escaping of user input.
Who is responsible for addressing CVE-2019-13407?
Manufacturers of the affected devices, such as Androvideo and Geovision, are responsible for providing security updates to mitigate CVE-2019-13407.