Command injection

2019-07-1418:15:00

PRIOn knowledge base

www.prio-n.com

9.8 High

AI Score

Confidence

High

0.032 Low

EPSS

Percentile

91.3%

JSON

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the “No unsafe lua allowed” code block is skipped.

CPENameOperatorVersion
vera_edge_firmwareeq1.7.4452

CPE	Name	Operator	Version
	vera_edge_firmware	eq	1.7.4452

References

distributedcompute.com/2019/07/13/vera-edge-home-controller-rce-via-unauthenticated-command-injection/