CVE-2017-9383
📋 TL;DR
This vulnerability allows remote command injection on VeraEdge and Veralite IoT devices through UPnP services. Attackers can execute arbitrary commands on the device by injecting malicious parameters into the wget service URL parameter. All users of affected Vera devices with UPnP enabled are vulnerable.
💻 Affected Systems
- Vera VeraEdge
- Vera Veralite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to execute arbitrary commands as root, install persistent backdoors, pivot to internal networks, and potentially brick devices.
Likely Case
Remote code execution leading to device takeover, credential theft, and use as botnet nodes or attack platforms.
If Mitigated
Limited impact if UPnP services are disabled or network access is restricted, though devices remain vulnerable to internal attackers.
🎯 Exploit Status
Exploitation requires no authentication and uses simple HTTP requests with command injection in URL parameters. Public exploit code exists in multiple repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer Vera devices or alternative platforms as VeraEdge/Veralite are end-of-life products.
🔧 Temporary Workarounds
Disable UPnP Services
allDisable UPnP functionality on affected devices to prevent exploitation
Access device web interface -> Settings -> Network -> Disable UPnP
Block External Access
linuxConfigure firewall to block external access to ports 3480 and 80
iptables -A INPUT -p tcp --dport 3480 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate affected devices on separate VLAN with strict network segmentation
- Implement network monitoring for suspicious traffic to/from port 3480
🔍 How to Verify
Check if Vulnerable:
Test if UPnP service responds on port 3480 or port 80 /port_3480 endpoint. Attempt to access http://device_ip:3480 or http://device_ip/port_3480Check Version:
Check device web interface or SSH to device and run 'cat /etc/version'Verify Fix Applied:
Verify UPnP services are disabled by checking that ports 3480 and 80 no longer respond to UPnP requests📡 Detection & Monitoring
Log Indicators:
- Unusual wget or curl commands in system logs
- HTTP requests to /port_3480 with suspicious URL parameters
- Command execution attempts in UPnP service logs
Network Indicators:
- HTTP POST/GET requests to port 3480 with shell metacharacters in parameters
- Outbound connections from device to unexpected external IPs following UPnP requests
SIEM Query:
source="device_logs" AND (url="*port_3480*" AND (param="*;*" OR param="*|*" OR param="*`*"))🔗 References
- http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
- https://seclists.org/bugtraq/2019/Jun/8
- http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
- https://seclists.org/bugtraq/2019/Jun/8
