Lucene search

[email protected]CVE-2019-15498

HistoryAug 23, 2019 - 4:15 a.m.

CVE-2019-15498

2019-08-2304:15:11

CWE-88

[email protected]

web.nvd.nist.gov

cve-2019-15498

vera edge

home controller

remote execution

os commands

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.

Affected configurations

NVD

Node

getveravera_edge_firmwareMatch1.7.4452

AND

getveravera_edgeMatch-

CPENameOperatorVersion
getvera:vera_edge_firmwaregetvera vera edge firmwareeq1.7.4452

CPE	Name	Operator	Version
getvera:vera_edge_firmware	getvera vera edge firmware	eq	1.7.4452

References

distributedcompute.com/2019/08/22/vera-edge-home-controller-remote-shell-via-unauthenticated-command-injection/

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

Related for CVE-2019-15498

cvelist1 prion1 nvd1