CVE-2019-13598

CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...

CVE-2019-15498

CVE-2019-15498 affects Vera Edge Home Controller 1.7.4452. The vulnerability is a remote command-injection in the CGI script at cgi-bin/cmh/webcam.sh, exploitable by unauthenticated users via the username parameter’s --output argument injection, enabling arbitrary OS command execution. The issue ...