CVE-2013-4863

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or (2) remote authenticated users to execute arbitrary Lua code via a RunLua action in a request to port_49451/upnp/control/hag.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/27286Exploit, Third Party Advisory, VDB Entry
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txtExploit
http://packetstormsecurity.com/files/122654/MiCasaVerde-VeraLite-1.5.408-Traversal-Authorization-CSRF-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/27286Exploit, Third Party Advisory, VDB Entry
https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-019.txtExploit

Timeline

Published: Jan 28, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-48649.8MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bi CVE-2013-48656.5Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to CVE-2013-48663.3The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attack CVE-2013-48676.3Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking CVE-2013-48685.3Karotz API 12.07.19.00: Session Token Information Disclosure CVE-2013-48690.0Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1 CVE-2013-48707.5SQL injection vulnerability in the News Search (news_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL comm CVE-2013-48716.8Cross-site request forgery (CSRF) vulnerability in the TEQneers SEO Enhancements (tq_seo) extension before 5.0.1 for TYPO3 allows remote att CVE-2013-48726.9Google Glass before XE6 does not properly restrict the processing of QR codes, which allows physically proximate attackers to modify the con CVE-2013-48735.0The Yahoo! Tumblr app before 3.4.1 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sni CVE-2013-48746.2The Uboot bootloader on the Verizon Wireless Network Extender SCS-26UC4 allows physically proximate attackers to obtain root access by conne CVE-2013-48756.2The Uboot bootloader on the Verizon Wireless Network Extender SCS-2U01 allows physically proximate attackers to bypass the intended boot pro