CVE-2013-4862

HighCVSS 8.1/10Last modified Jun 16, 2026

Description

MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firmware via the squashfs parameter to upgrade_step2.sh or (2) obtain hashed passwords via the cgi-bin/cmh/backup.sh page.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/27286Exploit, Third Party Advisory, VDB Entry
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txtExploit
http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/27286Exploit, Third Party Advisory, VDB Entry
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txtExploit

Timeline

Published: Jan 28, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-48638.8The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code vi CVE-2013-48649.8MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bi CVE-2013-48656.5Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to CVE-2013-48663.3The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attack CVE-2013-48676.3Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking CVE-2013-48685.3Karotz API 12.07.19.00: Session Token Information Disclosure CVE-2013-48690.0Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1 CVE-2013-48707.5SQL injection vulnerability in the News Search (news_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL comm CVE-2013-48716.8Cross-site request forgery (CSRF) vulnerability in the TEQneers SEO Enhancements (tq_seo) extension before 5.0.1 for TYPO3 allows remote att CVE-2013-48726.9Google Glass before XE6 does not properly restrict the processing of QR codes, which allows physically proximate attackers to modify the con CVE-2013-48735.0The Yahoo! Tumblr app before 3.4.1 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sni CVE-2013-48746.2The Uboot bootloader on the Verizon Wireless Network Extender SCS-26UC4 allows physically proximate attackers to obtain root access by conne