Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them

Summary: Cisco Talos discovered multiple vulnerabilities in the Abode Systems iota All-In-One Security Kit, versions 6.9X and 6.9Z, including format string injection flaws triggerable by malicious XML payloads and four vulnerabilities with a maximum 10 out of 10 CVSS score that allow arbitrary command execution with root privileges. Other flaws include an HTTP authentication bypass triggered by setting a header to a hard-coded value, a UDP service authentication bypass that permits disarming the device and changing its administrative credentials, and memory corruption issues reachable through authenticated web requests.
Key Takeaway: These are flaws in the hub and cameras guarding a home: the UDP authentication bypass alone lets a remote attacker disarm the device and rewrite its admin username and password, and the 10-out-of-10 CVSS issues yield root-level command execution. Abode has released an update, so the exposure sits with every iota kit still running versions 6.9X or 6.9Z.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-27804 CVE-2022-27805 CVE-2022-29472 CVE-2022-29475 CVE-2022-29477 CVE-2022-30541 CVE-2022-30603 CVE-2022-32574 CVE-2022-32586 CVE-2022-32773 CVE-2022-32775 CVE-2022-33189 CVE-2022-33192 CVE-2022-33195 CVE-2022-35244
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026