CVE-2019-11064

A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.

• CWE-200
• CWE-287

• http://surl.twcert.org.tw/gCDQNThird Party Advisory
• https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-mdExploit, Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201906005Third Party Advisory
• http://surl.twcert.org.tw/gCDQNThird Party Advisory
• https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-mdExploit, Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201906005Third Party Advisory

Published

Aug 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11059Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 6…
• CVE-2019-1106A remote code execution vulnerability exists in the way that…
• CVE-2019-11060The web api server on Port 8080 of ASUS HG100 firmware up to…7.5
• CVE-2019-11061A broken access control vulnerability in HG100 firmware vers…10
• CVE-2019-11062The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS C…9.8
• CVE-2019-11063A broken access control vulnerability in SmartHome app (Andr…10
• CVE-2019-11065Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL t…5.9
• CVE-2019-11066openid.php in LightOpenID through 1.3.1 allows SSRF via a cr…
• CVE-2019-11068libxslt through 1.1.33 allows bypass of a protection mechani…9.8
• CVE-2019-11069Sequelize version 5 before 5.3.0 does not properly ensure th…
• CVE-2019-1107A remote code execution vulnerability exists in the way that…
• CVE-2019-11070WebKitGTK and WPE WebKit prior to version 2.24.1 failed to p…