PT-2019-8652 · Vera · Veraedge+1

Mandar Satam · Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-9383

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vera VeraEdge version 1.7.19 Veralite version 1.7.481

Description An issue was discovered on Vera devices, where the UPnP services available on port 3480 and accessible via port 80 using the url "/port 3480" provide a "wget" service action. This action retrieves the URL parameter from the query string and passes it to an internal function that uses the curl module to retrieve the contents of the website.

Recommendations For Vera VeraEdge version 1.7.19, consider disabling the "wget" service action to prevent exploitation until a patch is available. For Veralite version 1.7.481, restrict access to the "/port 3480" url to minimize the risk of exploitation. As a temporary workaround, avoid using the URL parameter in the affected UPnP service until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-9383

Affected Products

Veraedge

Veralite

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-9383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9383 · Security Note
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html · Note
• https://t.me/cibsecurity/4963 · Telegram Post