CVE-2017-9388

Vulnerability

The Vera VeraEdge (firmware version 1.7.19) and Veralite (firmware version 1.7.481) devices include a web user interface that uses a script proxy.sh. This script is intended to proxy requests between the device and the Vera cloud service (https://home.getvera.com). The script accepts a url parameter without proper sanitization and passes it to eval to execute a curl command. An attacker can inject arbitrary commands by including shell metacharacters in the url parameter [1][2].

Exploitation

The attacker does not need authentication—the proxy.sh endpoint is accessible to unauthenticated network traffic. By sending a crafted HTTP request with a malicious url parameter containing command separators (e.g., ; or ` `), an attacker can break out of the intended curl` invocation and execute arbitrary operating system commands on the device. No user interaction or special privileges are required; only network access to the device's web interface is necessary [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server process, typically root. This results in full compromise of the device, including the ability to read sensitive data, modify configuration, disable security features, or use the device as a pivot point for further network attacks. The CVSS score of 9.8 (Critical) reflects the unauthenticated remote code execution capability [1][2].

Mitigation

Vera has not released a public patch for these specific firmware versions (1.7.19 for VeraEdge and 1.7.481 for Veralite). Users are advised to isolate the devices on a separate VLAN or restrict network access to the web interface (e.g., do not expose it to the internet). The devices have been reported as EOL (end-of-life) by some sources, increasing the risk of no official fix. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].