CVE-2017-9386

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows an attacker to directory traverse outside the /cmh-ext folder and read any file on the device. It is necessary to create the folder "cmh-ext" on the device which can be executed by an attacker first in an unauthenticated fashion and then execute a directory traversal attack.

• CWE-22

• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Published

Jun 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9380OpenEMR 5.0.0 and prior allows low-privilege users to upload…8.8
• CVE-2017-9381An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9382An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9383An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9384An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9385An issue was discovered on Vera Veralite 1.7.481 devices. Th…
• CVE-2017-9387An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9388An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9389An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9390An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9391An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9392An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…