high8.1Public exploit code
CVE-2013-4862
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squash…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities2013-08-02 · webapps · hardware · Verified
Impact
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Micasaverde | Veralite Firmware | Version 1.5.408 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html
- http://www.exploit-db.com/exploits/27286
- https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt
- http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.html
- http://www.exploit-db.com/exploits/27286
- https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txt