CVE-2017-9385

Vulnerability

Vera Veralite firmware version 1.7.481 contains a hidden OpenWRT management interface in addition to the standard web interface. This interface uses root as the username and retrieves the password from the file /etc/cmh/cmh.conf. An attacker can leverage a directory traversal vulnerability to read this configuration file, thereby obtaining the plaintext credentials for the highest-privilege account on the device [1].

Exploitation

The attacker needs network access to the device and must be able to send HTTP requests to the Vera Veralite web server. By exploiting a directory traversal flaw (no authentication required), the attacker can read arbitrary files, including /etc/cmh/cmh.conf, to extract the root password. Once the password is obtained, the attacker can log in to the hidden OpenWRT interface using root and the retrieved password, gaining full administrative control [1].

Impact

Successful exploitation results in complete compromise of the Vera Veralite device. The attacker obtains the highest possible privileges (root) on the device's Linux-based OpenWRT system, leading to full confidentiality, integrity, and availability loss. This can allow arbitrary command execution, modification of system files, interception of network traffic, and use of the device as a pivot point for further attacks [1].

Mitigation

The vendor has not released a fixed version for this vulnerability as of the publication date. Users should consider isolating the Vera Veralite device on a separate network segment, restricting access to the web interface to trusted hosts only, and monitoring for any suspicious activity. No workaround for the directory traversal or hardcoded credentials is available in the stated firmware version [1].