CVE-2017-9385 - CVE House
Back to Database
Status published Critical CVE-2017-9385

An issue was discovered on Vera Veralite 1.7.481 devices. The...

Vulnerability Description

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-9385

Credits & Attribution

No credits recorded in the NVD database.

References

More from getvera

View All →
CVE-2019-15498
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated...
High 8.8
CVE-2019-13598
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated...
Critical 9.8
CVE-2017-9392
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite...
High 8.8
CVE-2017-9391
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite...
High 8.8
CVE-2017-9390
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite...
Medium 6.1

Affected Vendor

Affected Software

veraedge firmware, veralite firmware
Vulnerable Versions:
0

Timeline

Official Publish: June 17th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.