CVE-2022-33205

🗓️ 25 Oct 2022 16:33:54Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 46 Views🌐 WEB

CVE-2022-33205 Four OS command injection vulnerabilities in Abode Systems iota All-In-One Security Ki

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2022-33205	25 Oct 202220:40	–	circl
CNNVD	Abode Iota 操作系统命令注入漏洞	25 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-33205	25 Oct 202216:33	–	cvelist
EUVD	EUVD-2022-36248	3 Oct 202520:07	–	euvd
NVD	CVE-2022-33205	25 Oct 202217:15	–	nvd
Prion	Command injection	25 Oct 202217:15	–	prion
Talos	Abode Systems, Inc. iota All-In-One Security Kit web interface /action/wirelessConnect OS command injection vulnerabilities	20 Oct 202200:00	–	talos
Vulnrichment	CVE-2022-33205	25 Oct 202216:33	–	vulnrichment

NVD

Vulners

Node

goabode iota_all-in-one_security_kit_firmwareMatch6.9x

goabode iota_all-in-one_security_kit_firmwareMatch6.9z

[
  {
    "vendor": "abode systems, inc.",
    "product": "iota All-In-One Security Kit",
    "versions": [
      {
        "version": "6.9X",
        "status": "affected"
      },
      {
        "version": "6.9Z",
        "status": "affected"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2022-1568

Parameter	Position	Path	Description	CWE
wpapsk_hex	query param	/action/wirelessConnect	Authenticated HTTP request leads to OS command injection via unsafe construction of commands using wpapsk_hex in /action/wirelessConnect.	CWE-78