What’s Vulnerable › Vulnerabilities

CVE-2020-8105: Command Execution due to unsanitized input

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-20 · updated 2026-06-17
• Weakness: CWE-78

Description

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz.

Affected products

• abode systems, inc. iota All-In-One Security Kit: before 1.0.2.23_6.9v_dev_t2_homekit_rf_2.0.19_s2_kvsabode_oz — fixed in 1.0.2.23_6.9v_dev_t2_homekit_rf_2.0.19_s2_kvsabode_oz

How to fix

Upgrade to a fixed version: abode systems, inc. iota All-In-One Security Kit 1.0.2.23_6.9v_dev_t2_homekit_rf_2.0.19_s2_kvsabode_oz. Check the vendor advisory for mitigations.

References

• https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-theabode-iota-security-system-fake-image-injectioninto-timeline
• https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-theabode-iota-security-system-fake-image-injectioninto-timeline

Get alerted when CVE-2020-8105 or the next vulnerability affects your stack