CVE-2017-9382

CVE-2017-9382 is a directory traversal vulnerability affecting Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. An authenticated attacker can exploit a flaw in the UPnP service, accessible via port 3480 or port 80, to read arbitrary files from the device's file system. The vulnerability stems from insufficient input sanitization in the "FileUtils::ReadFileIntoBuffer" function, allowing the use of "../" characters in the "parameters" query string. Rated with a CVSS v3.0 score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring only low privileges for successful exploitation. The primary impact is high confidentiality, enabling unauthorized information disclosure, with no impact on integrity or availability. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or attention.