Is CVE-2017-9387 actively exploited?

No active exploitation of CVE-2017-9387 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2017-9387 be exploited remotely?

Yes. CVE-2017-9387 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2017-9387?

CVE-2017-9387 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2017-9387

MEDIUM

CVE-2017-9387

CWE-79Published: June 17, 2019· Updated: Jun 17, 2026

5.4

CVSS v3.1

Official Description

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new SSH relays for the device so that the device connects to Vera servers. All the parameters passed in this specific script are logged to a log file called log.relay in the /tmp folder. The user can also read all the log files from the device using a script called log.sh. However, when the script loads the log files it displays them with content-type text/html and passes all the logs through the ansi2html binary which converts all the character text including HTML meta-characters correctly to be displayed in the browser. This allows an attacker to use the log files as a storing mechanism for the XSS payload and thus whenever a user navigates to that log.sh script, it enables the XSS payload and allows an attacker to execute his malicious payload on the user's browser.

NVD Source

Technical Analysis

CVE-2017-9387 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.