Back to Database
Status published
High
CVE-2022-29520
An OS command injection vulnerability exists in the console_main_loop :sys...
Vulnerability Description
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-29520
Credits & Attribution
No credits recorded in the NVD database.
More from abode systems, inc.
View All →CVE-2022-35887
Four format string injection vulnerabilities exist in the web interface...
High
8.2
CVE-2022-35886
Four format string injection vulnerabilities exist in the web interface...
High
8.2
CVE-2022-35885
Four format string injection vulnerabilities exist in the web interface...
High
8.2
CVE-2022-35884
Four format string injection vulnerabilities exist in the web interface...
High
8.2
CVE-2022-35881
Four format string injection vulnerabilities exist in the UPnP logging...
High
7.1
Affected Vendor
abode systems, inc.
View all reports →Affected Software
iota All-In-One Security Kit
Vulnerable Versions:
6.9Z
Timeline
Official Publish:
October 25th, 2022
Last Modified:
April 15th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.