What is CVE-2022-35884?

CVE-2022-35884 is a high-severity vulnerability in Abode Systems, Inc. Iota All-In-One Security Kit, classified under Use of Externally-Controlled Format String. CVSS score: 8.8/10. Published 2022-10-25.

How severe is CVE-2022-35884?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Abode Systems, Inc. Iota All-In-One Security Kit

CVE-2022-35884

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.

EPSS: 0.013 (66.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Abode Systems, Inc. Iota All-in-one Security Kit — versions 6.9X, 6.9Z
Goabode Iota_all-in-one_security_kit_firmware — versions 6.9x, 6.9z

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

talos-cna@cisco.com (Technical Description, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2022-35884?: CVE-2022-35884 is a high-severity vulnerability in Abode Systems, Inc. Iota All-In-One Security Kit, classified under Use of Externally-Controlled Format String. CVSS score: 8.8/10. Published 2022-10-25.
How severe is CVE-2022-35884?: High severity. CVSS v3 base score is 8.8 out of 10.