CVE-2022-29520

Summary

An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability.

Affected Software

VendorProductVersion RangeStatus
abode systems, inc.iota All-In-One Security Kit6.9Zaffected

Weaknesses

  • CWE-489: CWE-489: Leftover Debug Code

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References