CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

PT-2019-14226

Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved through argument injection in the username parameter to the "/cgi-bin/cmh/webcam.sh" API...

CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

Command injection

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-13598

CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...

PT-2019-13443

Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved via the code parameter to the "/port 3480/data request" API endpoint, where the "No unsafe...

CVE-2019-13598: Improper Neutralization of Special Elements used in an OS Command

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...