by Kastro
Paper/Archive/CVE-2020-8105

CVE-2020-8105

Abode iota All-In-One Security Kit — Command Execution due to unsanitized input

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.3.623 × 2012.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz.

Affected

ProductAffectedFixed inSource
iota All-In-One Security Kitunspecified – < 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE ozCNA

Scores by source

Bitdefender (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refbitdefender.com/blog/labs/vulnerabilities-identified-in-theabode-iota-security-system-fake-image-injectioninto-timeline