ID
VAR-202210-1547
CVE
CVE-2022-33195
TITLE
Abode Systems, Inc. of Abode iota All-In-One Security Kit in the firmware OS Command injection vulnerability
Trust: 0.8
DESCRIPTION
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_DefaultKeyID` in the function located at offset `0x1c7d28` of firmware 6.9Z, and even more specifically on the command execution occuring at offset `0x1c7fac`. Abode Systems, Inc. of Abode iota All-In-One Security Kit The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Abode Iota is a solid DIY home security system from Abode Corporation. An attacker can use this vulnerability to execute arbitrary commands
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9z | Trust: 1.0 |
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9x | Trust: 1.0 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9z | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9x | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-78 | Trust: 1.1 |
| problemtype: | OS Command injection (CWE-78) [ others ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
operating system commend injection
Trust: 0.6
PATCH
| title: | Abode Iota Fixes for operating system command injection vulnerabilities | url: | http://123.124.177.30/web/xxk/bdxqById.tag?id=212115 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-33195 | Trust: 3.3 |
| db: | TALOS | id: | TALOS-2022-1559 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2022-019862 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202210-2094 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-425334 | Trust: 0.1 |
REFERENCES
| url: | https://talosintelligence.com/vulnerability_reports/talos-2022-1559 | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-33195 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-33195/ | Trust: 0.6 |
SOURCES
| db: | VULHUB | id: | VHN-425334 |
| db: | JVNDB | id: | JVNDB-2022-019862 |
| db: | CNNVD | id: | CNNVD-202210-2094 |
| db: | NVD | id: | CVE-2022-33195 |
LAST UPDATE DATE
2024-08-14T14:10:30.920000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-425334 | date: | 2022-10-26T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019862 | date: | 2023-10-27T08:15:00 |
| db: | CNNVD | id: | CNNVD-202210-2094 | date: | 2022-10-27T00:00:00 |
| db: | NVD | id: | CVE-2022-33195 | date: | 2022-10-26T18:52:51.797 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-425334 | date: | 2022-10-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019862 | date: | 2023-10-27T00:00:00 |
| db: | CNNVD | id: | CNNVD-202210-2094 | date: | 2022-10-25T00:00:00 |
| db: | NVD | id: | CVE-2022-33195 | date: | 2022-10-25T17:15:53.087 |