CVE-2022-35885
First published: Tue Oct 25 2022(Updated: )
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Goabode Iota All-in-one Security Kit Firmware | =6.9x | |
| Goabode Iota All-in-one Security Kit Firmware | =6.9z |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-35885?
CVE-2022-35885 refers to four format string injection vulnerabilities in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X.
Where can I find more information about CVE-2022-35885?
You can find more information about CVE-2022-35885 in the Talos Intelligence vulnerability report at https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585.
What is the severity of CVE-2022-35885?
CVE-2022-35885 has a severity rating of 8.8 (High).
How does CVE-2022-35885 impact Abode Systems iota All-In-One Security Kit firmware version 6.9Z?
CVE-2022-35885 can lead to memory corruption, information disclosure, and denial of service in Abode Systems iota All-In-One Security Kit firmware version 6.9Z.
How does CVE-2022-35885 impact Abode Systems iota All-In-One Security Kit firmware version 6.9X?
CVE-2022-35885 can lead to memory corruption, information disclosure, and denial of service in Abode Systems iota All-In-One Security Kit firmware version 6.9X.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/goabode
- canonical/goabode iota all-in-one security kit firmware
- version/goabode iota all-in-one security kit firmware/6.9x
- version/goabode iota all-in-one security kit firmware/6.9z