CVE-2019-13598 Command injection in n/a
Remote unauthenticated attackers can execute arbitrary OS commands on Vera Edge Home Controllers via the code parameter in the LuaUPnP interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13598?
CVE-2019-13598 is a critical command injection vulnerability in n/a, published on 14 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_request because the "No unsafe lua allowed" code block is skipped.
Weakness: CWE-78
Which versions are affected by CVE-2019-13598?
It affects 1 product.
Products include Getvera Vera Edge Firmware.
How do I fix CVE-2019-13598?
No fix has been published for CVE-2019-13598 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-13598 being exploited?
There is no known exploitation of CVE-2019-13598 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2j3g-rxwp-8rq5.