CVE-2017-9389

Vulnerability

The VeraEdge firmware version 1.7.19 and Veralite firmware version 1.7.481 expose a web user interface that allows installing and executing Lua applications. The interface sends a POST request to the LuaUPNP daemon, which processes the Lua code in the code parameter via the function LU::LuaInterface::RunCode. This functionality is not protected by authentication, allowing arbitrary Lua code execution [1][2].

Exploitation

An attacker requires network access to the device (either local or Internet-facing if port forwarding is enabled). No authentication is needed. The attacker sends a crafted POST request containing malicious Lua code in the code parameter to the LuaUPNP endpoint. The daemon then executes the code without any checks [1].

Impact

Successful exploitation allows remote attackers to execute arbitrary Lua code with the privileges of the LuaUPNP daemon, which typically runs as root. This can lead to full device compromise, including data theft, configuration modification, or denial of service [1][2].

Mitigation

As of the publication date, no official patch was available. Users are advised to restrict network access to the device (e.g., disable remote administration, block ports used by Vera) and monitor vendor updates. The devices may be end-of-life; consider replacing them if security is critical [1][2].