PT-2022-20198 · Abode Systems · Iota All-In-One Security Kit

Matt Wiseman · Published 2022-10-25 · Updated 2022-10-26 · CVE-2022-30603

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z

Description An OS command injection issue exists in the web interface /action/iperf functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this issue.

Recommendations For versions 6.9X and 6.9Z, consider restricting access to the /action/iperf functionality until a patch is available. As a temporary workaround, avoid using the /action/iperf functionality in the web interface until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-30603

Affected Products

Iota All-In-One Security Kit

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1562 · Exploit
• https://osv.dev/vulnerability/CVE-2022-30603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30603 · Security Note
• https://t.me/cibsecurity/52033 · Telegram Post