Vulnerability in Abode Systems, Inc. Iota All-In-One Security Kit
CVE-2022-35884
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Abode Systems, Inc. Iota All-In-One Security Kit — versions 6.9X, 6.9Z
- Goabode Iota All-In-One Security Kit Firmware — versions 6.9x, 6.9z
Weakness classification (CWE)
References
- talosintelligence.com/vulnerability_reports/TALOS-2022-1585 (Technical Description, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-35884?
- CVE-2022-35884 is a high-severity vulnerability in Abode Systems, Inc. Iota All-In-One Security Kit, classified under Use of Externally-Controlled Format String. CVSS score: 8.8/10. Published 2022-10-25.
- How severe is CVE-2022-35884?
- High severity. CVSS v3 base score is 8.8 out of 10.