CVE-2017-9390

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script is "RedirectURL". However, the application lacks strict input validation of this parameter and this allows an attacker to execute the client-side code on this application.

• CWE-79

• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Published

Jun 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9384An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9385An issue was discovered on Vera Veralite 1.7.481 devices. Th…
• CVE-2017-9386An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9387An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9388An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9389An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9391An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9392An issue was discovered on Vera VeraEdge 1.7.19 and Veralite…
• CVE-2017-9393CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allow…
• CVE-2017-9394A stored cross-site scripting vulnerability in CA Identity G…
• CVE-2017-9403In LibTIFF 4.0.7, a memory leak vulnerability was found in t…
• CVE-2017-9404In LibTIFF 4.0.7, a memory leak vulnerability was found in t…