CVE-2022-35876 - Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc

Back Back to CVE browser

CRITICAL

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc

Published Oct 25, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 0.92%

Description

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` configuration parameters, as used within the `testWifiAP` XCMD handler

Affected products

Vendor Abode Systems, Inc. Product iota All-In-One Security Kit Default
n/a
- Version
  6.9X
  Status
  affected
  Constraints
  -
- Version
  6.9Z
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Abode Systems, Inc.

iota All-In-One Security Kit

n/a

Version	Status	Constraints
6.9X	affected	-
6.9Z	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-134

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38749
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581
ExploitTechnical DescriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38749		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581		ExploitTechnical DescriptionThird Party Advisory