MiCasaVerde VeraLite UPnP RCE

critical Nessus Plugin ID 93911

Language:

Synopsis

The remote device is affected by a remote code execution vulnerability.

Description

The remote MiCasaVerde VeraLite Smart Home Controller is affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this, via the UPnP RunLua action, to execute arbitrary shell commands as root.

Note that MiCasaVerde VeraLite is reportedly affected by additional vulnerabilities; however, Nessus has not tested for these.

Solution

The vendor has stated that they will not patch the vulnerability.

Plugin Details

Severity: Critical

ID: 93911

File Name: micasaverde_veralite_runlua.nasl

Version: 1.7

Type: remote

Family: Misc.

Published: 10/7/2016

Updated: 3/6/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: upnp/www

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 8/1/2013

Reference Information

CVE: CVE-2013-4863

BID: 61591

Detections

Analytics