CVE-2022-33195 describes four critical OS command injection vulnerabilities in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit firmware versions 6.9X and 6.9Z. An attacker can achieve arbitrary command execution by sending a sequence of malicious commands, specifically leveraging the unsafe use of WL_DefaultKeyID. This vulnerability has a CVSS score of 10.0 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV and Hot List are inactive), no public Metasploit or ExploitDB modules, and no media coverage, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness and potential for future exploit development.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.9xCPE matchmatch criteria | cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:*:*:*:*:*:*:* | ||
6.9zCPE matchmatch criteria | cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.