Abode Systems vulnerabilities

We track 37 vulnerabilities in Abode Systems products. 37 are rated high or critical, and none are known to be exploited. The most recent was published on October 25, 2022.

37vulnerabilities

24critical

13high

0exploited

9.4average CVSS score

Latest Abode Systems vulnerabilities

8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35887Oct 25, 2022Abode SystemsEPSS 1.48%
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35886Oct 25, 2022Abode SystemsEPSS 1.48%
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35885Oct 25, 2022Abode SystemsEPSS 1.48%
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35884Oct 25, 2022Abode SystemsEPSS 1.48%
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35881Oct 25, 2022Abode Systems
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35880Oct 25, 2022Abode Systems
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35879Oct 25, 2022Abode Systems
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35878Oct 25, 2022Abode Systems
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35877Oct 25, 2022Abode SystemsEPSS 1.03%
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35876Oct 25, 2022Abode SystemsEPSS 1.03%
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35875Oct 25, 2022Abode SystemsEPSS 1.03%
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35874Oct 25, 2022Abode SystemsEPSS 1.03%
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-35244Oct 25, 2022Abode SystemsEPSS 1.44%
A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attac
9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
CVE-2022-33938Oct 25, 2022Abode SystemsEPSS 1.14%
A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of ser
9.9 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33207Oct 25, 2022Abode SystemsEPSS 4.63%
Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker
9.9 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33206Oct 25, 2022Abode SystemsEPSS 4.63%
Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker
9.9 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33205Oct 25, 2022Abode SystemsEPSS 4.63%
Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker
9.9 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33204Oct 25, 2022Abode SystemsEPSS 4.63%
Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker
10.0 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33195Oct 25, 2022Abode SystemsEPSS 3.5%
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri
10.0 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33194Oct 25, 2022Abode SystemsEPSS 3.4%
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri
10.0 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33193Oct 25, 2022Abode SystemsEPSS 3.4%
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri
10.0 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33192Oct 25, 2022Abode SystemsEPSS 3.5%
Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-33189Oct 25, 2022Abode SystemsEPSS 3.73%
An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger
8.8 High severity
iota All-In-One Security Kit: Integer Overflow or Wraparound
CVE-2022-32775Oct 25, 2022Abode SystemsEPSS 1.65%
An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authe
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-32773Oct 25, 2022Abode SystemsEPSS 3.5%
An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to
7.5 High severity
iota All-In-One Security Kit: Active Debug Code
CVE-2022-32760Oct 25, 2022Abode SystemsEPSS 1.05%
A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to denial of service. An attacker can send a malicious XML payload to trigger this v
8.8 High severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-32586Oct 25, 2022Abode SystemsEPSS 4.08%
An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can
9.8 Critical severity
iota All-In-One Security Kit: Stack-based Buffer Overflow
CVE-2022-32454Oct 25, 2022Abode SystemsEPSS 2.08%
A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to
8.8 High severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-30603Oct 25, 2022Abode SystemsEPSS 5.61%
An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an a
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-30541Oct 25, 2022Abode SystemsEPSS 3.42%
An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to
9.8 Critical severity
iota All-In-One Security Kit: Use of Hard-coded Credentials
CVE-2022-29889Oct 25, 2022Abode SystemsEPSS 1.49%
A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-29520Oct 25, 2022Abode SystemsEPSS 3.08%
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger
9.8 Critical severity
iota All-In-One Security Kit: Use of Hard-coded Credentials
CVE-2022-29477Oct 25, 2022Abode SystemsEPSS 1.39%
An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP
8.1 High severity
iota All-In-One Security Kit: Authentication Bypass by Capture-replay
CVE-2022-29475Oct 25, 2022Abode Systems
An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-m
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-29472Oct 25, 2022Abode SystemsEPSS 4.78%
An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can sen
9.8 Critical severity
iota All-In-One Security Kit: Improper Access Control
CVE-2022-27805Oct 25, 2022Abode SystemsEPSS 1.57%
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML p
9.8 Critical severity
iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27804Oct 25, 2022Abode SystemsEPSS 3.92%
An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can sen