PT-2022-21742 · Abode Systems · Iota All-In-One Security Kit

Matt Wiseman · Published 2022-10-25 · Updated 2022-10-27 · CVE-2022-33205

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X through 6.9Z

Description The web interface /action/wirelessConnect functionality contains OS command injection vulnerabilities. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities, focusing on the unsafe use of the wpapsk hex HTTP parameter to construct an OS Command at offset 0x19b0ac of the /root/hpgw binary.

Recommendations For versions 6.9X through 6.9Z, consider disabling the /action/wirelessConnect functionality until a patch is available. Restrict access to the /root/hpgw binary to minimize the risk of exploitation. Avoid using the wpapsk hex parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-33205

Affected Products

Iota All-In-One Security Kit

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-33205 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33205 · Vendor Advisory
• https://t.me/cibsecurity/52050 · Telegram Post