PT-2022-19676 · Abode Systems · Iota All-In-One Security Kit

Matt Wiseman · Published 2022-10-25 · Updated 2023-06-28 · CVE-2022-29520

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit version 6.9Z

Description An OS command injection issue exists in the console main loop :sys functionality. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this issue.

Recommendations For version 6.9Z, consider restricting access to the console main loop :sys functionality until a patch is available. As a temporary workaround, avoid using specially-crafted XCMDs in the affected functionality.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-489

CWE-78

Related Identifiers

CVE-2022-29520

Affected Products

Iota All-In-One Security Kit

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1561 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29520 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29520 · Vendor Advisory
• https://t.me/cibsecurity/52042 · Telegram Post