CVE-2019-13407: Androvideo Vd 1 Firmware

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.

Affected products

• Androvideo Vd 1 Firmware: up to and including 230
• GeoVision Gv-VD8700 Firmware: up to and including 1.01
• GeoVision Gv-VR360 Firmware: up to and including 1.10

Published 2019-08-29. Last modified 2026-06-17.