CVE-2022-35886

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` HTTP parameters, as used within the `/action/wirelessConnect` handler.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

8.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS

1.30% chance of exploitation in the next 30 days, 68th percentile

Published

2022-10-25

Updated

2025-04-15

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585

References

• CVE Record
• NVD entry

Related

• CVE-2022-35885
• CVE-2022-35887
• CVE-2022-35884
• CVE-2022-35890
• CVE-2022-35881
• CVE-2022-35899