Exploitation Summary
EIP tracks 1 public exploit for CVE-2013-4862. PoCs published by Trustwave's SpiderLabs.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in MiCasaVerde VeraLite, including path traversal, insufficient authorization checks, and CSRF. It provides proof-of-concept code for arbitrary file disclosure, privilege escalation via firmware updates, and remote code execution through Lua code injection.
Description
MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in MiCasaVerde VeraLite, including path traversal, insufficient authorization checks, and CSRF. It provides proof-of-concept code for arbitrary file disclosure, privilege escalation via firmware updates, and remote code execution through Lua code injection.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N