An issue was discovered on Vera Veralite 1.7.481 devices.
Priority MEDIUM 48CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.
Why it matters now
EPSS 0.03543 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:getvera:veraedge_firmware:*:*:*:*:*:*:*:* | up to 1.7.19 | Vulnerable | Getvera |
| cpe:2.3:h:getvera:veraedge:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Getvera |
| cpe:2.3:o:getvera:veralite_firmware:*:*:*:*:*:*:*:* | up to 1.7.481 | Vulnerable | Getvera |
| cpe:2.3:h:getvera:veralite:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Getvera |
- cpe:2.3:o:getvera:veraedge_firmware:*:*:*:*:*:*:*:* Versions up to 1.7.19 Vulnerable ·Getvera
- cpe:2.3:h:getvera:veraedge:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Getvera
- cpe:2.3:o:getvera:veralite_firmware:*:*:*:*:*:*:*:* Versions up to 1.7.481 Vulnerable ·Getvera
- cpe:2.3:h:getvera:veralite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Getvera
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9385
- 2026-10-03 Alias added: GHSA-jpp8-9286-h8x5
References
More Getvera Veraedge Firmware vulnerabilities
- TI-2017-06807 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0CRITICAL 9.9
- TI-2017-06816 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0HIGH 8.8
- TI-2017-06815 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0HIGH 8.8
- TI-2017-06813 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0HIGH 8.8
- TI-2017-06812 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0HIGH 8.8
- TI-2017-06808 An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. CVSS 3.0HIGH 8.8
Sources
- CVE-2017-9385 · CVE Program
- CVE-2017-9385 · NVD
- FIRST EPSS
- GHSA-jpp8-9286-h8x5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences