PT-2020-7515 · Micasaverde · Veralite

Daniel Crowley · Published 2020-01-28 · Updated 2020-02-04 · CVE-2013-4865

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408

Description: A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests, enabling the installation of arbitrary firmware via the squashfs parameter. This can be exploited by sending malicious requests to the affected system.

Recommendations: For MiCasaVerde VeraLite version 1.5.408, consider restricting access to the upgrade step2.sh script and the squashfs parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the squashfs parameter in requests until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-4865

Affected Products

Veralite

References · 6

• 🔥 https://exploit-db.com/exploits/27286 · Exploit
• 🔥 http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html · Exploit
• 🔥 https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt · Exploit
• 🔥 http://exploit-db.com/exploits/27286 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4865 · Security Note
• https://t.me/cvenotify/534 · Telegram Post