CVE-2022-32773

Vulnerability

The iota All-In-One Security Kit (6.9X and 6.9Z) contains an OS command injection vulnerability in the XCMD doDebug functionality. The device receives command and control messages (XCMDs) via an XMPP connection, and additionally a service on UDP/55050 allows unauthenticated access to execute XCMDs. A specially-crafted XML payload can inject OS commands. [1]

Exploitation

An attacker can exploit this vulnerability without authentication by sending a malicious XCMD XML payload to the iota device's UDP/55050 service. No user interaction is required. The attacker must have network access to the device. [1]

Impact

Successful exploitation leads to arbitrary command execution with high privileges, potentially allowing full compromise of the device and lateral movement. The CVSSv3 score is 10.0, indicating critical impact on confidentiality, integrity, and availability. [1]

Mitigation

As of the publication date (2022-10-25), no patched version has been released. Abode Systems has not confirmed a fix. Users should restrict network access to the iota device, monitor for updates, or contact the vendor for guidance. [1]