OS Command Injection Vulnerabilities in Abode Systems iota All-In-One Security Kit
CVE-2022-33204

10CRITICAL

Key Information:

Vendor
Adobe
Status
Iota All-in-one Security Kit
Vendor
CVE Published:
25 October 2022

Summary

Abode Systems iota All-In-One Security Kit contains multiple OS command injection vulnerabilities through the /action/wirelessConnect functionality. These vulnerabilities can be exploited by an authenticated attacker using specially-crafted HTTP requests, which manipulate the unsafe handling of the ssid_hex HTTP parameter. Successful exploitation may allow the execution of arbitrary commands on the affected device firmware, specifically impacting the binary located at offset 0x19afc0 in firmware versions 6.9Z and 6.9X.

Affected Version(s)

iota All-In-One Security Kit 6.9X

iota All-In-One Security Kit 6.9Z

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.