Lucene search

[email protected]CVE-2019-13598

HistoryJul 14, 2019 - 6:15 p.m.

CVE-2019-13598

2019-07-1418:15:10

CWE-78

[email protected]

web.nvd.nist.gov

112

cve-2019-13598

luaupnp

vera edge home controller

remote execution

arbitrary os commands

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.032 Low

EPSS

Percentile

91.3%

JSON

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the “No unsafe lua allowed” code block is skipped.

Affected configurations

NVD

Node

getveravera_edge_firmwareMatch1.7.4452

AND

getveravera_edgeMatch-

CPENameOperatorVersion
getvera:vera_edge_firmwaregetvera vera edge firmwareeq1.7.4452

CPE	Name	Operator	Version
getvera:vera_edge_firmware	getvera vera edge firmware	eq	1.7.4452

References

distributedcompute.com/2019/07/13/vera-edge-home-controller-rce-via-unauthenticated-command-injection/

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.032 Low

EPSS

Percentile

91.3%

JSON

Related for CVE-2019-13598

prion1 nvd1 cvelist1