CVE-2022-30603

Vulnerability summary (CVE-2022-30603) : Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) exposes an OS command-injection in the web interface endpoint /action/iperf. The POST handler collects a user-supplied server_ip and unsafely interpolates it into a shell command, then execute...

CVE-2022-30541

The CVE-2022-30541 issue affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. Talos confirms an OS command injection in the XCMD setUPnP handler, where an XMPP XML payload contains a webextport value that, if crafted, can bypass normal checks and lead to OS command execution. The pay...

CVE-2022-29520

CVE-2022-29520 affects Abode Systems iota All-In-One Security Kit (firmware 6.9Z). A crafted XCMD via setUPnP webextport can feed data into /var/in, which console_main_loop then parses as commands and executes through popen, enabling arbitrary command execution as root. TALOS details describe 6.9...

CVE-2022-29477

An authentication bypass vulnerability exists in the web interface /action/factory functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-29475

CVE-2022-29475 affects Abode Systems iota All-In-One Security Kit by way of the XFINDER service on UDP/55030. Talos confirms an information disclosure vulnerability that enables an attacker to replay credentials (the Auth field) after observing XFINDER traffic, enabling an authentication bypass a...

CVE-2022-29472

Summary (CVE-2022-29472): Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) suffers an OS command injection in the web interface’s util_set_serial_mac. A specially crafted HTTP POST to /action/factorySerialMacPost can cause arbitrary commands to run as root by manipulating the U-Boo...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-27805

An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML payload to trigger this vulnerability...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially cause data integrity issues by sending specially crafted messages...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially cause data integrity issues by sending specially crafted messages...

Abode Iota operating system command injection vulnerability

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. An attacker could execute arbitrary commands by exploiting this vulnerability...

Abode Iota operating system command injection vulnerability

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. An attacker could exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...

Abode Iota: Format string error vulnerability

Abode Iota is a reliable Diy home security system from Abode. A format string error vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. The vulnerability stems from a format string injection vulnerability in the XCMD testWifiAP feature, which allows an attacker to...

PT-2022-21730

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit version 6.9Z Description A command injection issue exists in the XCMD setAlexa functionality, allowing arbitrary command execution through a specially-crafted XCMD. An attacker can exploit this ...

PT-2022-19640

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description An information disclosure issue exists in the XFINDER functionality. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker...

PT-2022-21329

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality. This can be triggered by a specially-crafted XCMD, leading to remote cod...

PT-2022-21457

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X through 6.9Z Description An integer overflow issue exists in the web interface /action/ipcamRecordPost functionality. A specially-crafted HTTP request can lead to memory corruption...

PT-2022-21732

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description The issue is related to OS command injection vulnerabilities in the XCMD testWifiAP functionality. These vulnerabilities can lead to arbitrary command executio...

CVE-2022-35887: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacke...

CVE-2022-35885: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacke...