CVE-2019-13407CWE-79

Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi

published August 29, 2019

CVSS
—
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01053 · 64.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2019-08-29T00:19Z
EPSS history
Timeline
  • 29 AUG 00:19Z
    Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi
    cvelistv5