CVE-2022-29520

An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability.

• CWE-489
• CWE-78

• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1561Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1561Exploit, Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29515Missing release of memory after effective lifetime in firmwa…5.5
• CVE-2022-29516The web console of FUJITSU Network IPCOM series (IPCOM EX2 I…9.8
• CVE-2022-29517A directory traversal vulnerability exists in the HelpdeskAc…8.8
• CVE-2022-29518Screen Creator Advance2, HMI GC-A2 series, and Real time rem…7
• CVE-2022-29519Cleartext transmission of sensitive information vulnerabilit…7.5
• CVE-2022-2952GE CIMPICITY versions 2022 and prior is vulnerable when da…7.8
• CVE-2022-29522Use after free vulnerability exists in the simulator module …7.8
• CVE-2022-29523Improper conditions check in the Open CAS software maintaine…5.5
• CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
• CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
• CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Pri…5.3
• CVE-2022-29527Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a worl…7