PT-2019-8651 · Vera · Veraedge+1

Mandar Satam · Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-9382

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vera VeraEdge version 1.7.19 Veralite version 1.7.481

Description An issue was discovered in the UPnP services provided by the device, which are available on port 3480 and can also be accessed via port 80 using the url "/port 3480". The UPnP services provide "file" as one of the service actions, allowing a normal user to read a file stored under the /etc/cmh-lu folder. The parameters query string variable is used to retrieve the value, which is then passed to the internal function FileUtils::ReadFileIntoBuffer. This function does not perform any sanitization on the submitted value, allowing an attacker to use directory traversal characters "../" and read files from other folders within the device.

Recommendations For Vera VeraEdge version 1.7.19, consider disabling the UPnP services on port 3480 and restrict access to the "/port 3480" url until a patch is available. For Veralite version 1.7.481, consider disabling the UPnP services on port 3480 and restrict access to the "/port 3480" url until a patch is available. As a temporary workaround, consider restricting the use of the FileUtils::ReadFileIntoBuffer function until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-9382

Affected Products

Veraedge

Veralite

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-9382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9382 · Security Note
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html · Note
• https://t.me/cibsecurity/4964 · Telegram Post