CVE-2022-33204

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `ssid_hex` HTTP parameter to construct an OS Command at offset `0x19afc0` of the `/root/hpgw` binary included in firmware 6.9Z.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568	Exploit Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:::::::*
	cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:::::::*

History

21 Nov 2024, 07:07

Type	Values Removed	Values Added
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568 - Exploit, Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568 - Exploit, Third Party Advisory

Information

Published : 2022-10-25 17:15

Updated : 2024-11-21 07:07

NVD link : CVE-2022-33204

Mitre link : CVE-2022-33204

CVE.ORG link : CVE-2022-33204

JSON object : View

Products Affected

goabode

iota_all-in-one_security_kit_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2022-33204", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2022-10-25T17:15:53.147", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1568", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `ssid_hex` HTTP parameter to construct an OS Command at offset `0x19afc0` of the `/root/hpgw` binary included in firmware 6.9Z."}, {"lang": "es", "value": "Se presentan cuatro vulnerabilidades de inyecci\u00f3n de comandos del Sistema Operativo en la funcionalidad de la interfaz web /action/wirelessConnect de Abode Systems, Inc. iota All-In-One Security Kit versiones 6.9X y 6.9Z. Una petici\u00f3n HTTP especialmente dise\u00f1ada puede conllevar a una ejecuci\u00f3n de un comando arbitrario. Un atacante puede realizar una petici\u00f3n HTTP autenticada para activar estas vulnerabilidades. Esta vulnerabilidad es centrada en el uso no seguro del par\u00e1metro HTTP \"ssid_hex\" para construir un comando del Sistema Operativo en el offset \"0x19afc0\" del binario \"/root/hpgw\" incluido en el firmware 6.9Z"}], "lastModified": "2024-11-21T07:07:42.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9341C371-6AC1-428C-809E-7856975E8FC3"}, {"criteria": "cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA9202A4-4D07-4293-93EE-73183AEEE5E0"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}