CVE-2019-13598

2019-07-1417:22:04

mitre

www.cve.org

9.9 High

AI Score

Confidence

High

0.032 Low

EPSS

Percentile

91.3%

JSON

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the “No unsafe lua allowed” code block is skipped.

References

distributedcompute.com/2019/07/13/vera-edge-home-controller-rce-via-unauthenticated-command-injection/