CVE-2013-4862 - MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page

Back Back to CVE browser

HIGH

MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page

Published Jan 28, 2020

8.1

HIGH

CVSS 3.1

EPSS 3.72%

Description

MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (4)

http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/27286
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-4707
Advisory
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt
x_refsource_MISCExploit

Link	Providers	Tags
http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/27286		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-4707		Advisory
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt		x_refsource_MISCExploit