PT-2021-12710 · Abode · Abode Iota All-In-One Security Kit

Bitdefender Labs · Published 2021-12-20 · Updated 2022-01-03 · CVE-2020-8105

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Abode iota All-In-One Security Kit versions prior to 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz.

Description: The issue is an OS Command Injection vulnerability in the wirelessConnect handler of the Abode iota All-In-One Security Kit. This vulnerability allows an attacker to inject commands and gain root access.

Recommendations: For Abode iota All-In-One Security Kit versions prior to 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz., update to version 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz. or later to resolve the issue. As a temporary workaround, consider restricting access to the wirelessConnect handler until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-8105

Affected Products

Abode Iota All-In-One Security Kit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-8105 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8105 · Vendor Advisory
• https://bitdefender.com/blog/labs/vulnerabilities-identified-in-theabode-iota-security-system-fake-image-injectioninto-timeline · Note
• https://t.me/cibsecurity/34275 · Telegram Post