CVE-2022-35877
First published: Tue Oct 25 2022(Updated: )
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` configuration parameter, as used within the `testWifiAP` XCMD handler
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Goabode Iota All-in-one Security Kit Firmware | =6.9x | |
| Goabode Iota All-in-one Security Kit Firmware | =6.9z |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of these format string injection vulnerabilities in Abode Systems, Inc. iota All-In-One Security Kit?
The vulnerability ID is CVE-2022-35877.
What is the severity rating of CVE-2022-35877?
The severity rating of CVE-2022-35877 is critical with a value of 9.8.
What is the description of CVE-2022-35877?
CVE-2022-35877 refers to four format string injection vulnerabilities in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. These vulnerabilities can result in memory corruption, information disclosure, and denial of service.
Which software versions are affected by CVE-2022-35877?
CVE-2022-35877 affects Goabode Iota All-in-one Security Kit Firmware versions 6.9X and 6.9Z.
Is there any additional reference material available for CVE-2022-35877?
Yes, you can find additional reference material at the following link: [https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581).
- collector/nvd-index
- agent/references
- agent/severity
- agent/tags
- agent/event
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/goabode
- canonical/goabode iota all-in-one security kit firmware
- version/goabode iota all-in-one security kit firmware/6.9x
- version/goabode iota all-in-one security kit firmware/6.9z