CVE-2017-9382

Vulnerability

The VeraEdge firmware version 1.7.19 and Veralite firmware version 1.7.481 contain a directory traversal vulnerability in their UPnP services. The UPnP interface is available on port 3480 and can also be accessed via port 80 using the URL /port_3480 [1]. The service provides a file action intended to read files from the /etc/cmh-lu folder. The action retrieves the file path from the parameters query string variable and passes it unsanitized to the internal function FileUtils::ReadFileIntoBuffer. Because no sanitization is performed, an attacker can supply directory traversal sequences such as ../ to read arbitrary files from other directories on the device [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the device's UPnP endpoint (port 3480 or port 80 via /port_3480). The attacker does not require authentication. The attack involves providing a parameters query string value containing directory traversal characters (e.g., ../) to escape the intended /etc/cmh-lu folder and specify a target file path on the device [1]. No user interaction or special network position beyond network access to the device is needed.

Impact

Successful exploitation allows an unauthenticated attacker to read any file on the device that is accessible to the UPnP process. This can lead to disclosure of sensitive information, including configuration files, credentials, or other system data. The impact is limited to information disclosure; the attacker does not gain code execution or write access via this vulnerability [1].

Mitigation

As of the publication date (2019-06-17), no firmware updates addressing this vulnerability were available for VeraEdge or Veralite devices. Users should monitor the vendor's official channels for patches. If a fix is not provided, network segmentation and restricting access to ports 3480 and 80 to trusted networks only can reduce the risk of exploitation [1]. There is no indication that this CVE is listed in the CISA KEV catalog.