CVE-2022-32586

Abode Systems iota All-In-One Security Kit (versions 6.9X and 6.9Z) contains an OS command injection vulnerability in the web interface endpoint /action/ipcamRecordPost. The TALOS-2022-1563 write-up confirms that an authenticated HTTP request can trigger arbitrary command execution by parsing POS...

CVE-2022-32574

The CVE-2022-32574 entry relates to Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) and is triggered via the web interface POST /action/ipcamSetParamPost. Talos details confirm a double-free vulnerability in the handling of a POST payload, where an attacker-controlled size paramet...

CVE-2022-32454

A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-30603

Vulnerability summary (CVE-2022-30603) : Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) exposes an OS command-injection in the web interface endpoint /action/iperf. The POST handler collects a user-supplied server_ip and unsafely interpolates it into a shell command, then execute...

CVE-2022-30541

The CVE-2022-30541 issue affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. Talos confirms an OS command injection in the XCMD setUPnP handler, where an XMPP XML payload contains a webextport value that, if crafted, can bypass normal checks and lead to OS command execution. The pay...

CVE-2022-29520

CVE-2022-29520 affects Abode Systems iota All-In-One Security Kit (firmware 6.9Z). A crafted XCMD via setUPnP webextport can feed data into /var/in, which console_main_loop then parses as commands and executes through popen, enabling arbitrary command execution as root. TALOS details describe 6.9...

CVE-2022-29477

An authentication bypass vulnerability exists in the web interface /action/factory functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-29475

CVE-2022-29475 affects Abode Systems iota All-In-One Security Kit by way of the XFINDER service on UDP/55030. Talos confirms an information disclosure vulnerability that enables an attacker to replay credentials (the Auth field) after observing XFINDER traffic, enabling an authentication bypass a...

CVE-2022-29472

Summary (CVE-2022-29472): Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) suffers an OS command injection in the web interface’s util_set_serial_mac. A specially crafted HTTP POST to /action/factorySerialMacPost can cause arbitrary commands to run as root by manipulating the U-Boo...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-27805

An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-33207: Improper Neutralization of Special Elements used in an OS Command

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP reque...

CVE-2022-29889: Use of Hard-coded Credentials

A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability...

CVE-2022-35885: Use of Externally-Controlled Format String

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacke...

Abode Iota 操作系统命令注入漏洞

Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota All-In-One Security Kit versions 6.9X and 6.9Z. An attacker could exploit this vulnerability to execute arbitrary commands via specially crafted HTTP requests...

CVE-2022-32454: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to trigger this vulnerability...

CVE-2022-32775: Integer Overflow or Wraparound

An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authenticated HTTP request to trigger this...

PT-2022-18600 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: A command injection issue exists in the web interface's util set abode code functionality, allowing arbitrary command execution via a specially-crafted HTTP...

PT-2022-20198 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: An OS command injection issue exists in the web interface /action/iperf functionality. A specially-crafted HTTP request can lead to arbitrary command...

PT-2022-21387 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: A command injection issue exists in the web interface /action/ipcamRecordPost functionality. This allows an attacker to execute arbitrary commands via a...