CVE-2013-4862

Vulnerability

The MiCasaVerde VeraLite home automation controller running firmware version 1.5.408 does not properly enforce access controls between Administrator and Guest user roles [1][2]. Specifically, the web interface fails to restrict Guest users from accessing certain sensitive functionalities. Two primary vectors are exposed: the squashfs parameter in upgrade_step2.sh allows a Guest to push custom firmware, and the cgi-bin/cmh/backup.sh page allows retrieval of hashed passwords without requiring Administrator privileges [1][2].

Exploitation

An attacker requires a valid Guest-level account on the VeraLite console, which can be obtained via the local network or through the cloud-based control panel at cp.mios.com [2]. With Guest access, the attacker can directly call upgrade_step2.sh with a crafted squashfs parameter to upload malicious firmware, or access cgi-bin/cmh/backup.sh to retrieve a backup file containing hashed passwords [1][2]. No additional authentication bypass or user interaction is needed beyond the Guest account credentials.

Impact

Successful exploitation allows a Guest user to achieve privilege escalation in two ways: (1) by installing custom firmware, the attacker can gain full control over the device, potentially affecting all home automation functions and network presence; (2) by obtaining password hashes from the backup file, the attacker can attempt offline cracking to recover plaintext passwords, leading to unauthorized root-level access [1][2]. The outcome is a complete compromise of the integrity and confidentiality of the home automation system.

Mitigation

No official firmware patch has been released by MiCasaVerde for this vulnerability, and the VeraLite product is now end-of-life [2]. Affected users should replace the device with a supported model or apply strict network segmentation to limit access to the VeraLite console to trusted users only. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [2].