CVE-2019-13406: Androvideo Vd 1 Firmware

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.

Affected products

• Androvideo Vd 1 Firmware: up to and including 230

Published 2019-08-29. Last modified 2026-06-17.