Vtim Hsu

**Name of the Vulnerable Software and Affected Versions** Advan VD-1 firmware versions up to 230 **Description** A remote credential disclosure issue was found, allowing an attacker to export system configuration without encryption, thereby accessing the administrator's account and password in plain text. This can be achieved via the "cgibin/ExportSettings.cgi?Export=1" endpoint without requiring any authentication. **Recommendations** For Advan VD-1 firmware versions up to 230, as a temporary workaround, consider restricting access to the "cgibin/ExportSettings.cgi" endpoint until a patch is available. Additionally, avoid using the ExportSettings.cgi endpoint with the `Export=1` parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advan VD-1 firmware version 230 **Description** A broken access control issue allows an attacker to send a POST request to "cgibin/AdbSetting.cgi" and enable ADB without authentication, potentially leading to the device being used as a relay or for installing mining software. **Recommendations** For Advan VD-1 firmware version 230, consider disabling the ADB service until a patch is available to prevent exploitation. Restrict access to the "cgibin/AdbSetting.cgi" endpoint to minimize the risk of unauthorized ADB enablement.

**Name of the Vulnerable Software and Affected Versions** Advan VD-1 firmware versions up to 230 **Description** A cross-site scripting (XSS) issue is present due to improper escaping of error messages. When a requested resource is not found in the page cgibin/ssi.cgi, the VD-1 responds with a path error message, leading to a reflected XSS. **Recommendations** For Advan VD-1 firmware versions up to 230, update to a version higher than 230 to resolve the issue. As a temporary workaround, consider restricting access to the cgibin/ssi.cgi page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Advan VD-1 firmware versions up to 230 **Description** A relative path traversal issue allows attackers to download arbitrary files without authentication via the API endpoint "/cgi-bin/ExportSettings.cgi" with the `Download` parameter set to `filepath`. **Recommendations** For Advan VD-1 firmware versions up to 230, consider restricting access to the "/cgi-bin/ExportSettings.cgi" endpoint until a patch is available. As a temporary workaround, avoid using the `Download` parameter in the affected API endpoint.