CVE-2013-4861

Vulnerability

A path traversal vulnerability exists in the cgi-bin/cmh/get_file.sh script of MiCasaVerde VeraLite firmware version 1.5.408. The script does not properly sanitize the filename parameter, allowing an attacker to use .. sequences to escape the intended directory and read arbitrary files on the system. However, the directory used by the script must exist for the traversal to succeed; on a fresh device this directory does not exist, but it can be created by first calling cgi-bin/cmh/store_file.sh?store_file=test [1][2].

Exploitation

An attacker must be an authenticated user (either admin or guest) on the VeraLite. The attack can be performed locally on the local network or remotely via the internet-based control panel at cp.mios.com when logged in. The attacker first creates the required directory by sending a GET request to store_file.sh with a dummy filename. Then, they send a GET request to get_file.sh with a filename parameter containing ../ sequences to traverse to the target file, e.g., ../../../../../etc/passwd [1][2].

Impact

Successful exploitation allows the attacker to read the contents of any file on the system. This includes sensitive files such as /etc/passwd, which contains hashed root passwords and, if remote access is configured, the tech support remote access password. Disclosure of these credentials could lead to further compromise of the device or network [1][2].

Mitigation

No official fix has been identified in the available references. The vendor may have released a firmware update after the advisory date (August 2013), but no specific patched version is mentioned. Users should consider isolating the VeraLite from untrusted networks, restricting access to the web interface, or upgrading to a newer model if available. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.