CVE-2022-29475

Published: Oct 25, 2022Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Affected (2)

Products: Goabode: Iota All In One Security Kit Firmware

1 product

Iota All In One Security Kit Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Goabode Iota All In One Security Kit Firmware	Version 6.9z

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Goabode Iota All In One Security Kit Firmware	Version 6.9x

Running on/with	Platform Versions
Goabode Iota All In One Security Kit	All versions

Related CWEs

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1553

Source: talos-cna@cisco.com

ExploitThird Party Advisory

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1553

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.