CVE-2022-32760

Affected product: Abode Systems iota All-In-One Security Kit (versions 6.9X–6.9Z). Vulnerability vector: XCMD doDebug function accepts a crafted XML payload via XMPP; specifically the parameter triggers a fault. Root cause: doDebug parses crash and writes to address 0x0, crashing the /root/hpgw ...

CVE-2022-32586

Abode Systems iota All-In-One Security Kit (versions 6.9X and 6.9Z) contains an OS command injection vulnerability in the web interface endpoint /action/ipcamRecordPost. The TALOS-2022-1563 write-up confirms that an authenticated HTTP request can trigger arbitrary command execution by parsing POS...

CVE-2022-30603

Vulnerability summary (CVE-2022-30603) : Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) exposes an OS command-injection in the web interface endpoint /action/iperf. The POST handler collects a user-supplied server_ip and unsafely interpolates it into a shell command, then execute...

CVE-2022-30541

The CVE-2022-30541 issue affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. Talos confirms an OS command injection in the XCMD setUPnP handler, where an XMPP XML payload contains a webextport value that, if crafted, can bypass normal checks and lead to OS command execution. The pay...

CVE-2022-29475

CVE-2022-29475 affects Abode Systems iota All-In-One Security Kit by way of the XFINDER service on UDP/55030. Talos confirms an information disclosure vulnerability that enables an attacker to replay credentials (the Auth field) after observing XFINDER traffic, enabling an authentication bypass a...

CVE-2022-35880: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicio...

CVE-2022-33194: Improper Neutralization of Special Elements used in an OS Command

Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This...

CVE-2022-35876: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

PT-2022-21742

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X through 6.9Z Description The web interface /action/wirelessConnect functionality contains OS command injection vulnerabilities. A specially-crafted HTTP request can lead to arbitra...

CVE-2022-35881: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicio...

CVE-2022-33205: Improper Neutralization of Special Elements used in an OS Command

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP reque...

CVE-2022-35878: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicio...

CVE-2022-35244: Use of Externally-Controlled Format String

A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attacker can send a malicious XML payload ...

PT-2022-21329

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality. This can be triggered by a specially-crafted XCMD, leading to remote cod...

CVE-2022-29472: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-29889: Use of Hard-coded Credentials

A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability...

PT-2022-22989

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z and 6.9X Description The issue arises from format string injection vulnerabilities in the UPnP logging functionality. A specially-crafted UPnP negotiation can lead to memory...

PT-2022-22992

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z and 6.9X Description The issue arises from format string injection vulnerabilities in the UPnP logging functionality. A specially-crafted UPnP negotiation can lead to memory...

CVE-2022-35884: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacke...

CVE-2022-29520: Active Debug Code

An OS command injection vulnerability exists in the consolemainloop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability...