CVE-2022-27804

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-278059.8An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X anCVE-2022-278067.2On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurCVE-2022-278074.3Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add CatCVE-2022-278087.8Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 maCVE-2022-27815.3In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and vCVE-2022-278107.5It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.CVE-2022-278119.8GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.CVE-2022-278127.5Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can leaCVE-2022-278138.2Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoCVE-2022-278143.3SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.CVE-2022-278157.8SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.CVE-2022-278167.1SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.