PT-2022-20198 · Abode Systems · Iota All-In-One Security Kit

Matt Wiseman

·

CVE-2022-30603

·

Published

2022-10-25

·

Updated

2022-10-26

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z
Description An OS command injection issue exists in the web interface /action/iperf functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this issue.
Recommendations For versions 6.9X and 6.9Z, consider restricting access to the /action/iperf functionality until a patch is available. As a temporary workaround, avoid using the /action/iperf functionality in the web interface until the issue is resolved.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-30603

Affected Products

Iota All-In-One Security Kit