PT-2022-21741 · Abode Systems · Iota All-In-One Security Kit

Matt Wiseman

·

Published

2022-10-25

·

Updated

2022-10-27

·

CVE-2022-33204

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z
Description The issue is related to OS command injection vulnerabilities in the web interface /action/wirelessConnect functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities, which focuses on the unsafe use of the ssid hex HTTP parameter to construct an OS Command at offset 0x19afc0 of the /root/hpgw binary included in firmware 6.9Z.
Recommendations For version 6.9X, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For version 6.9Z, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /action/wirelessConnect functionality to minimize the risk of exploitation. Avoid using the ssid hex parameter in the affected HTTP request until the issue is resolved.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-33204

Affected Products

Iota All-In-One Security Kit