CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the "No unsafe lua allowed" code block is skipped.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
getveravera_edge_firmware
1.7.4452
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://distributedcompute.com/2019/07/13/vera-edge-home-controller-rce-via-unauthenticated-command-injection/
https://distributedcompute.com/2019/07/13/vera-edge-home-controller-rce-via-unauthenticated-command-injection/