TI-2020-06525 Aliases CVE-2020-8105 GHSA-q6hj-32jx-jh7w

Command Execution due to unsanitized input

MEDIUM 43CWE-78Published 2021-12-20 · Updated 2024-09-17

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz.

Why it matters now

EPSS 0.00981 62nd percentileScored 2026-11-07

Fix Fixed iota All-In-One Security Kit (Abode): 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Abode	iota All-In-One Security Kit	before 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz	1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz	Patch available	CNA

iota All-In-One Security Kit VendorAbode Affected before 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz Fixed in 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware::::::::	before 1.0.2.23_6.9v_dev_t2_homekit_rf_2.0.19_s2_kvsabode_oz	Vulnerable	abode systems, inc.
cpe:2.3:h:goabode:iota_all-in-one_security_kit:-:::::::*	not specified by NVD	Running on	abode systems, inc.

cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:*:*:*:*:*:*:*:* Versions before 1.0.2.23_6.9v_dev_t2_homekit_rf_2.0.19_s2_kvsabode_oz Vulnerable ·abode systems, inc.
cpe:2.3:h:goabode:iota_all-in-one_security_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·abode systems, inc.

Remediation

Fix · CNA iota All-In-One Security Kit (Abode) Fixed in 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz

Timeline

2026-10-02 Threatist record created from CVE-2020-8105
2026-10-03 Alias added: GHSA-q6hj-32jx-jh7w

References

Advisory 1

https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-theabode-iota-security-system-fake-image-injectioninto-timeline

TI-2022-15924 A format string injection vulnerability exists in the XCMD getVarHA functionality of… CVSS 3.1CRITICAL 9.8
TI-2022-14636 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14635 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14634 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14633 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14627 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 10.0

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences