CVE-2020-8105

Name of the Vulnerable Software and Affected Versions: Abode iota All-In-One Security Kit versions prior to 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz.

Description: The issue is an OS Command Injection vulnerability in the wirelessConnect handler of the Abode iota All-In-One Security Kit. This vulnerability allows an attacker to inject commands and gain root access.

Recommendations: For Abode iota All-In-One Security Kit versions prior to 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz., update to version 1.0.2.23 6.9V dev t2 homekit RF 2.0.19 s2 kvsABODE oz. or later to resolve the issue. As a temporary workaround, consider restricting access to the wirelessConnect handler until a patch is available.