Details of VAR-202210-1576

ID

VAR-202210-1576

CVE

CVE-2022-33205

TITLE

Abode Systems, Inc. of Abode iota All-In-One Security Kit in the firmware OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-019860

DESCRIPTION

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `wpapsk_hex` HTTP parameter to construct an OS Command at offset `0x19b0ac` of the `/root/hpgw` binary included in firmware 6.9Z. Abode Systems, Inc. of Abode iota All-In-One Security Kit The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Abode Iota is a solid DIY home security system from Abode Corporation

Trust: 2.25

sources: NVD: CVE-2022-33205 // JVNDB: JVNDB-2022-019860 // CNNVD: CNNVD-202210-2089 // VULHUB: VHN-425336

AFFECTED PRODUCTS

vendor:	goabode	model:	iota all-in-one security kit	scope:	eq	version:	6.9z	Trust: 1.0
vendor:	goabode	model:	iota all-in-one security kit	scope:	eq	version:	6.9x	Trust: 1.0
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	abode iota all-in-one security kit firmware 6.9z	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	-	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	abode iota all-in-one security kit firmware 6.9x	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-019860 // NVD: CVE-2022-33205

CVSS

SEVERITY

CVSSV2

CVSSV3

talos-cna@cisco.com:	CVE-2022-33205
value:	CRITICAL
Trust: 1.0
nvd@nist.gov:	CVE-2022-33205
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2022-33205
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202210-2089
value:	CRITICAL
Trust: 0.6

talos-cna@cisco.com:	CVE-2022-33205
baseSeverity:	CRITICAL
baseScore:	10.0
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	6.0
version:	3.0
Trust: 1.0
nvd@nist.gov:	CVE-2022-33205
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-33205
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-019860 // CNNVD: CNNVD-202210-2089 // NVD: CVE-2022-33205 // NVD: CVE-2022-33205

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: VULHUB: VHN-425336 // JVNDB: JVNDB-2022-019860 // NVD: CVE-2022-33205

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-2089

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202210-2089

PATCH

title:

Abode Iota Fixes for operating system command injection vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqById.tag?id=212218

Trust: 0.6

sources: CNNVD: CNNVD-202210-2089

EXTERNAL IDS

db:	NVD	id:	CVE-2022-33205	Trust: 3.3
db:	TALOS	id:	TALOS-2022-1568	Trust: 2.5
db:	JVNDB	id:	JVNDB-2022-019860	Trust: 0.8
db:	CNNVD	id:	CNNVD-202210-2089	Trust: 0.6
db:	VULHUB	id:	VHN-425336	Trust: 0.1

sources: VULHUB: VHN-425336 // JVNDB: JVNDB-2022-019860 // CNNVD: CNNVD-202210-2089 // NVD: CVE-2022-33205

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2022-1568	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-33205	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-33205/	Trust: 0.6

sources: VULHUB: VHN-425336 // JVNDB: JVNDB-2022-019860 // CNNVD: CNNVD-202210-2089 // NVD: CVE-2022-33205

SOURCES

db:	VULHUB	id:	VHN-425336
db:	JVNDB	id:	JVNDB-2022-019860
db:	CNNVD	id:	CNNVD-202210-2089
db:	NVD	id:	CVE-2022-33205

LAST UPDATE DATE

2024-08-14T13:21:35.372000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-425336	date:	2022-10-27T00:00:00
db:	JVNDB	id:	JVNDB-2022-019860	date:	2023-10-27T08:15:00
db:	CNNVD	id:	CNNVD-202210-2089	date:	2022-10-28T00:00:00
db:	NVD	id:	CVE-2022-33205	date:	2022-10-27T13:24:18.577

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-425336	date:	2022-10-25T00:00:00
db:	JVNDB	id:	JVNDB-2022-019860	date:	2023-10-27T00:00:00
db:	CNNVD	id:	CNNVD-202210-2089	date:	2022-10-25T00:00:00
db:	NVD	id:	CVE-2022-33205	date:	2022-10-25T17:15:53.207