Details of VAR-202210-1578

ID

VAR-202210-1578

CVE

CVE-2022-33207

TITLE

Abode Systems, Inc. of Abode iota All-In-One Security Kit in the firmware OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-019858

DESCRIPTION

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on a second unsafe use of the `default_key_id` HTTP parameter to construct an OS Command at offset `0x19B234` of the `/root/hpgw` binary included in firmware 6.9Z. Abode Systems, Inc. of Abode iota All-In-One Security Kit The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Abode Iota is a solid DIY home security system from Abode Corporation

Trust: 2.25

sources: NVD: CVE-2022-33207 // JVNDB: JVNDB-2022-019858 // CNNVD: CNNVD-202210-2087 // VULHUB: VHN-425338

AFFECTED PRODUCTS

vendor:	goabode	model:	iota all-in-one security kit	scope:	eq	version:	6.9z	Trust: 1.0
vendor:	goabode	model:	iota all-in-one security kit	scope:	eq	version:	6.9x	Trust: 1.0
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	abode iota all-in-one security kit firmware 6.9z	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	-	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	eq	version:	abode iota all-in-one security kit firmware 6.9x	Trust: 0.8
vendor:	abode	model:	iota all-in-one security kit	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-019858 // NVD: CVE-2022-33207

CVSS

SEVERITY

CVSSV2

CVSSV3

talos-cna@cisco.com:	CVE-2022-33207
value:	CRITICAL
Trust: 1.0
nvd@nist.gov:	CVE-2022-33207
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2022-33207
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202210-2087
value:	CRITICAL
Trust: 0.6

talos-cna@cisco.com:	CVE-2022-33207
baseSeverity:	CRITICAL
baseScore:	10.0
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	6.0
version:	3.0
Trust: 1.0
nvd@nist.gov:	CVE-2022-33207
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-33207
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-019858 // CNNVD: CNNVD-202210-2087 // NVD: CVE-2022-33207 // NVD: CVE-2022-33207

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: VULHUB: VHN-425338 // JVNDB: JVNDB-2022-019858 // NVD: CVE-2022-33207

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-2087

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202210-2087

PATCH

title:

Abode Iota Fixes for operating system command injection vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqById.tag?id=212216

Trust: 0.6

sources: CNNVD: CNNVD-202210-2087

EXTERNAL IDS

db:	NVD	id:	CVE-2022-33207	Trust: 3.3
db:	TALOS	id:	TALOS-2022-1568	Trust: 2.5
db:	JVNDB	id:	JVNDB-2022-019858	Trust: 0.8
db:	CNNVD	id:	CNNVD-202210-2087	Trust: 0.6
db:	VULHUB	id:	VHN-425338	Trust: 0.1

sources: VULHUB: VHN-425338 // JVNDB: JVNDB-2022-019858 // CNNVD: CNNVD-202210-2087 // NVD: CVE-2022-33207

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2022-1568	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-33207	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-33207/	Trust: 0.6

sources: VULHUB: VHN-425338 // JVNDB: JVNDB-2022-019858 // CNNVD: CNNVD-202210-2087 // NVD: CVE-2022-33207

SOURCES

db:	VULHUB	id:	VHN-425338
db:	JVNDB	id:	JVNDB-2022-019858
db:	CNNVD	id:	CNNVD-202210-2087
db:	NVD	id:	CVE-2022-33207

LAST UPDATE DATE

2024-08-14T13:21:35.399000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-425338	date:	2022-10-27T00:00:00
db:	JVNDB	id:	JVNDB-2022-019858	date:	2023-10-27T08:14:00
db:	CNNVD	id:	CNNVD-202210-2087	date:	2022-10-28T00:00:00
db:	NVD	id:	CVE-2022-33207	date:	2022-10-27T13:23:53.917

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-425338	date:	2022-10-25T00:00:00
db:	JVNDB	id:	JVNDB-2022-019858	date:	2023-10-27T00:00:00
db:	CNNVD	id:	CNNVD-202210-2087	date:	2022-10-25T00:00:00
db:	NVD	id:	CVE-2022-33207	date:	2022-10-25T17:15:53.320