CVE-2022-32454

Abode Systems, Inc. iota All-In-One Security Kit (versions 6.9X and 6.9Z) is affected by CVE-2022-32454 due to a stack-based buffer overflow in the XCMD setIPCam handler. The root cause is an unsafe strcpy into a 32-byte ipcam_1.name field when processing a crafted XML payload, enabling attacker-...

CVE-2022-32454

A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-30603

Vulnerability summary (CVE-2022-30603) : Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) exposes an OS command-injection in the web interface endpoint /action/iperf. The POST handler collects a user-supplied server_ip and unsafely interpolates it into a shell command, then execute...

CVE-2022-30603

An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2022-30603

An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2022-30541

An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-30541

An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-30541

The CVE-2022-30541 issue affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. Talos confirms an OS command injection in the XCMD setUPnP handler, where an XMPP XML payload contains a webextport value that, if crafted, can bypass normal checks and lead to OS command execution. The pay...

CVE-2022-29889

CVE-2022-29889 affects Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Talos reports a telnet service on TCP/55023 with a root password derived from the device MAC address; the password is generated by a hard-coded process in the /root/hpgw binary, enabling arbitrary command execution if a...

CVE-2022-29889

A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability...

CVE-2022-29889

A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability...

CVE-2022-29520

An OS command injection vulnerability exists in the consolemainloop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability...

CVE-2022-29520

CVE-2022-29520 affects Abode Systems iota All-In-One Security Kit (firmware 6.9Z). A crafted XCMD via setUPnP webextport can feed data into /var/in, which console_main_loop then parses as commands and executes through popen, enabling arbitrary command execution as root. TALOS details describe 6.9...

CVE-2022-29520

An OS command injection vulnerability exists in the consolemainloop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability...

CVE-2022-29477

CVE-2022-29477 affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. The vulnerability is an authentication bypass in the web interface’s /action/factory* endpoints caused by a hard-coded HTTP header check (X-Climax-Tag: Factory-27940001-21245121). If a request includes the correct he...

CVE-2022-29477

An authentication bypass vulnerability exists in the web interface /action/factory functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-29475

An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-29472

Summary (CVE-2022-29472): Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) suffers an OS command injection in the web interface’s util_set_serial_mac. A specially crafted HTTP POST to /action/factorySerialMacPost can cause arbitrary commands to run as root by manipulating the U-Boo...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...