PT-2019-8658 · Vera · Veraedge+1

Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-9389

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vera VeraEdge version 1.7.19 Veralite version 1.7.481

Description An issue was discovered in the devices, allowing an attacker to run arbitrary Lua code due to the lack of authentication protection for the Lua code installation functionality. The device's web user interface enables users to manage the device and install Lua applications. The code parameter value is passed to the LU::LuaInterface::RunCode(char const*) function, which loads the Lua engine and runs the code. This is handled by the LU::JobHandler LuaUPnP::RunLua(LU::JobHandler LuaUPnP * hidden this, LU::UPnPActionWrapper *) function in the LuaUPNP daemon.

Recommendations For Vera VeraEdge version 1.7.19, consider disabling the Lua code installation functionality until a patch is available. For Veralite version 1.7.481, restrict access to the LuaUPNP daemon to minimize the risk of exploitation. As a temporary workaround, consider disabling the LU::JobHandler LuaUPnP::RunLua function until a patch is available. Avoid using the code parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-9389

Affected Products

Veraedge

Veralite

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9389 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9389 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html · Note
• https://t.me/cibsecurity/4959 · Telegram Post