CVE-2022-33207

2022-10-2517:15:53

CWE-78

[email protected]

web.nvd.nist.gov

command injection

web interface

abode systems inc

security kit

arbitrary command execution

authenticated http request

firmware 6.9z

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

60.3%

JSON

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on a second unsafe use of the default_key_id HTTP parameter to construct an OS Command at offset 0x19B234 of the /root/hpgw binary included in firmware 6.9Z.