CVE-2022-33206

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `key` and `default_key_id` HTTP parameters to construct an OS Command crafted at offset `0x19b1f4` of the `/root/hpgw` binary included in firmware 6.9Z.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-332079.9Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-CVE-2022-332088.1Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machi CVE-2022-332097.8Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially CVE-2022-33218.2It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-s CVE-2022-332107.8Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large CVE-2022-332119.8memory corruption in modem due to improper check while calculating size of serialized CoAP message CVE-2022-332138.8Memory corruption in modem due to buffer overflow while processing a PPP packet CVE-2022-332147.0Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon C CVE-2022-332165.5Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.CVE-2022-332177.8Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kern CVE-2022-332187.8Memory corruption in Automotive due to improper input validation.CVE-2022-332197.8Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.