CVE-2017-9392

Vera Edge 1.7.19 and Veralite 1.7.481 expose a UPnP action (request_image) on port 3480 (and port 80 via /port_3480). The res parameter in the query is unsafely copied into a stack buffer by LU::Generic_IP_Camera_Manager::GetUrlFromArguments using sprintf without length checks, enabling buffer ov...

CVE-2017-9391

CVE-2017-9391 affects Vera VeraEdge 1.7.19 and Veralite 1.7.481. A UPnP action (request_image) exposed on ports 3480/80 allows unsanitized URL parameters to be stored on the stack, enabling a buffer overflow when more than 1336 characters are supplied. The overflow targets stack values including ...

CVE-2017-9391

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "requestimage" as one of the service actions for ...

CVE-2017-9382

The CVE-2017-9382 entry affects Vera VeraEdge (1.7.19) and Veralite (1.7.481). UPnP services exposed on port 3480 (and accessible on port 80 via /port_3480) allow a normal user to trigger a file read from /etc/cmh-lu by supplying a path via the parameters query string. The path is passed to FileU...

CVE-2017-9382

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "file" as one of the service actions for a normal...

CVE-2017-9383

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "wget" as one of the service actions for a normal...

CVE-2017-9383

The CVE-2017-9383 entry applies to Vera VeraEdge 1.7.19 and Veralite 1.7.481. UPnP services are exposed on port 3480 (and accessible via /port_3480 on port 80) and expose a “wget” action that allows a normal user to connect the device to an external website. The exploit path retrieves the query p...

CVE-2017-9385

CVE-2017-9385 affects Vera Veralite 1.7.481 devices. An extra OpenWRT interface alongside the standard web UI allows highest-privilege access after an attacker exploits a directory traversal to extract the root password from /etc/cmh/cmh.conf, enabling login with root-equivalent privileges. Docum...

CVE-2017-9385

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the...

CVE-2017-9386

The CVE-2017-9386 entry concerns Vera VeraEdge (1.7.19) and Veralite (1.7.481). A script file get_file.sh on the device allows a user to read files within the cmh-ext folder, but the filename parameter is not properly validated, enabling directory traversal outside /cmh-ext to read arbitrary file...

CVE-2017-9386

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "getfile.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows a...

CVE-2017-9389

CVE-2017-9389 affects Vera VeraEdge (1.7.19) and Veralite (1.7.481). The web UI allows users to install and write Lua applications without authentication. A POST carries user-provided Lua code to the LuaUPNP daemon, which handles it in LU::JobHandler_LuaUPnP::RunLua and passes the code to LU::Lua...

CVE-2017-9389

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device allows a user to install applications written in the Lua programming language. Also the interfa...

CVE-2017-9387

CVE-2017-9387 affects Vera VeraEdge 1.7.19 and Veralite 1.7.481. A shell script (relay.sh) creates SSH relays and logs all parameters to /tmp/log.relay; a companion log.sh reads those logs. Logs are served as text/html and processed by ansi2html, allowing an attacker to store an XSS payload in th...

CVE-2017-9390

Vulnerability CVE-2017-9390 affects Vera VeraEdge (1.7.19) and Veralite (1.7.481). The connect.sh script authenticates to home.getvera.com but fails to validate the RedirectURL parameter, allowing an attacker to execute client-side code in the application. This describes an input validation flaw ...

CVE-2017-9390

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script ...

CVE-2017-9381

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection...

CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

CVE-2017-9384

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports a...

CVE-2017-9381

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection...