Iota All-in-one Security Kit Firmware vulnerabilities

37 known vulnerabilities in Iota All-in-one Security Kit Firmware from Goabode. 37 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35887Oct 25, 2022Abode SystemsEPSS 1.48%

  Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35886Oct 25, 2022Abode SystemsEPSS 1.48%

  Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35885Oct 25, 2022Abode SystemsEPSS 1.48%

  Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35884Oct 25, 2022Abode SystemsEPSS 1.48%

  Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35881Oct 25, 2022Abode Systems

  Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35880Oct 25, 2022Abode Systems

  Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35879Oct 25, 2022Abode Systems

  Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se

• 8.8 High severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35878Oct 25, 2022Abode Systems

  Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35877Oct 25, 2022Abode SystemsEPSS 1.03%

  Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35876Oct 25, 2022Abode SystemsEPSS 1.03%

  Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35875Oct 25, 2022Abode SystemsEPSS 1.03%

  Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35874Oct 25, 2022Abode SystemsEPSS 1.03%

  Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-35244Oct 25, 2022Abode SystemsEPSS 1.44%

  A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attac

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Externally-Controlled Format String

  CVE-2022-33938Oct 25, 2022Abode SystemsEPSS 1.14%

  A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of ser

• 9.9 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33207Oct 25, 2022Abode SystemsEPSS 4.63%

  Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker

• 9.9 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33206Oct 25, 2022Abode SystemsEPSS 4.63%

  Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker

• 9.9 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33205Oct 25, 2022Abode SystemsEPSS 4.63%

  Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker

• 9.9 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33204Oct 25, 2022Abode SystemsEPSS 4.63%

  Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker

• 10.0 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33195Oct 25, 2022Abode SystemsEPSS 3.5%

  Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri

• 10.0 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33194Oct 25, 2022Abode SystemsEPSS 3.4%

  Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri

• 10.0 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33193Oct 25, 2022Abode SystemsEPSS 3.4%

  Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri

• 10.0 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33192Oct 25, 2022Abode SystemsEPSS 3.5%

  Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to tri

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-33189Oct 25, 2022Abode SystemsEPSS 3.73%

  An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger

• 8.8 High severity

  iota All-In-One Security Kit: Integer Overflow or Wraparound

  CVE-2022-32775Oct 25, 2022Abode SystemsEPSS 1.65%

  An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to memory corruption. An attacker can make an authe

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-32773Oct 25, 2022Abode SystemsEPSS 3.5%

  An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to

• 7.5 High severity

  iota All-In-One Security Kit: Active Debug Code

  CVE-2022-32760Oct 25, 2022Abode SystemsEPSS 1.05%

  A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to denial of service. An attacker can send a malicious XML payload to trigger this v

• 8.8 High severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-32586Oct 25, 2022Abode SystemsEPSS 4.08%

  An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can

• 9.8 Critical severity

  iota All-In-One Security Kit: Stack-based Buffer Overflow

  CVE-2022-32454Oct 25, 2022Abode SystemsEPSS 2.08%

  A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to remote code execution. An attacker can send a malicious XML payload to

• 8.8 High severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-30603Oct 25, 2022Abode SystemsEPSS 5.61%

  An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an a

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-30541Oct 25, 2022Abode SystemsEPSS 3.42%

  An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Hard-coded Credentials

  CVE-2022-29889Oct 25, 2022Abode SystemsEPSS 1.49%

  A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-29520Oct 25, 2022Abode SystemsEPSS 3.08%

  An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger

• 9.8 Critical severity

  iota All-In-One Security Kit: Use of Hard-coded Credentials

  CVE-2022-29477Oct 25, 2022Abode SystemsEPSS 1.39%

  An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An attacker can send an HTTP

• 8.1 High severity

  iota All-In-One Security Kit: Authentication Bypass by Capture-replay

  CVE-2022-29475Oct 25, 2022Abode Systems

  An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-m

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-29472Oct 25, 2022Abode SystemsEPSS 4.78%

  An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can sen

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Access Control

  CVE-2022-27805Oct 25, 2022Abode SystemsEPSS 1.57%

  An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML p

• 9.8 Critical severity

  iota All-In-One Security Kit: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-27804Oct 25, 2022Abode SystemsEPSS 3.92%

  An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can sen