CVE-2022-29475 Information disclosure in iota All-In-One Security Kit
A man-in-the-middle attack on the XFINDER functionality allows attackers to disclose information and escalate privileges on Abode security kits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-29475?
CVE-2022-29475 is a medium-severity vulnerability in abode systems, inc. iota All-In-One Security Kit, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Weakness: CWE-294
Which versions are affected by CVE-2022-29475?
It affects 1 product.
Products include Goabode Iota All-in-One Security Kit Firmware.
How do I fix CVE-2022-29475?
No fix has been published for CVE-2022-29475 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-29475 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-29475 exists.
Other vulnerabilities in abode systems, inc. iota All-In-One Security Kit
- CVE-2022-29472 Command injection in iota All-In-One Security Kit
- CVE-2022-30541 Command injection in iota All-In-One Security Kit
- CVE-2022-30603 Command injection in iota All-In-One Security Kit
- CVE-2022-32454 Memory corruption in iota All-In-One Security Kit
- CVE-2022-32773 Command injection in iota All-In-One Security Kit
Sources
Also known as GHSA-gvc3-rhv6-6x2c.