CVE-2013-4863

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408

Description: The issue allows remote attackers to execute arbitrary Lua code via a RunLua action in a request to "upnp/control/hag" on port 49451. Additionally, remote authenticated users can execute arbitrary Lua code via a RunLua action in a request to "port 49451/upnp/control/hag".

Recommendations: For version 1.5.408, consider disabling the RunLua action in the HomeAutomationGateway service as a temporary workaround until a patch is available. Restrict access to the "upnp/control/hag" endpoint on port 49451 to minimize the risk of exploitation. Avoid using the RunLua action in requests to "port 49451/upnp/control/hag" until the issue is resolved.