PT-2022-21455 · Unknown · Iota All-In-One Security Kit

Matt Wiseman · Published 2022-10-25 · Updated 2022-10-26 · CVE-2022-32773

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iota All-In-One Security Kit versions 6.9X and 6.9Z

Description A command injection issue exists in the XCMD doDebug functionality, allowing for arbitrary command execution through a specially-crafted XCMD. This can be triggered by sending a malicious XML payload.

Recommendations For versions 6.9X and 6.9Z, consider disabling the XCMD doDebug functionality as a temporary workaround until a patch is available. Restrict access to the XCMD functionality to minimize the risk of exploitation. Avoid using the XCMD doDebug functionality until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-32773

Affected Products

Iota All-In-One Security Kit

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1556 · Exploit
• https://osv.dev/vulnerability/CVE-2022-32773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32773 · Security Note