CVE-2017-9383
First published: Mon Jun 17 2019(Updated: )
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "wget" as one of the service actions for a normal user to connect the device to an external website. It retrieves the parameter "URL" from the query string and then passes it to an internal function that uses the curl module on the device to retrieve the contents of the website.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Getvera Vera Edge Firmware | <=1.7.19 | |
| Getvera Vera Edge | ||
| VeraLite Firmware | <=1.7.481 | |
| MiCasaVerde VeraLite |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-9383?
The severity of CVE-2017-9383 is critical with a severity value of 9.9.
Which devices are affected by CVE-2017-9383?
Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices are affected by CVE-2017-9383.
What are the affected software versions of CVE-2017-9383?
The affected software versions of CVE-2017-9383 are Vera VeraEdge Firmware up to and including 1.7.19 and VeraLite Firmware up to and including 1.7.481.
What is the vulnerability description of CVE-2017-9383?
CVE-2017-9383 is a vulnerability discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices that allows for XSS, command injection, CSRF, and traversal attacks.
Are VeraEdge and VeraLite devices vulnerable to CVE-2017-9383?
VeraEdge devices are vulnerable to CVE-2017-9383, while VeraLite devices are not vulnerable.
- agent/type
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/getvera
- canonical/getvera vera edge firmware
- version/getvera vera edge firmware/1.7.19
- canonical/getvera vera edge
- canonical/veralite firmware
- version/veralite firmware/1.7.481
- canonical/micasaverde veralite