CVE-2017-9385

Name: CVE-2017-9385
Creator: NVD / NIST
Published: 2019-06-17T20:15:09.29+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.54%

Last modified Jun 17, 2026

CVE-2017-9385 is a vulnerability of currently unknown severity. An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. EPSS estimates a 3.54% chance of exploitation in the next 30 days.

Description

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.

Metrics

EPSS Probability

3.54%

87.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-255

Affected Software

Vendor	Product	Versions
Getvera	Veraedge Firmware	<= 1.7.19
Getvera	Veralite Firmware	<= 1.7.481

References

http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Timeline

Published: Jun 17, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-9385?

How severe is CVE-2017-9385?

Severity scoring for CVE-2017-9385 is pending analysis. The EPSS model estimates a 3.54% probability of exploitation in the next 30 days.

How do I fix CVE-2017-9385?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-9385?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST