CVE-2022-35886
First published: Tue Oct 25 2022(Updated: )
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` HTTP parameters, as used within the `/action/wirelessConnect` handler.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Goabode Iota All-in-one Security Kit Firmware | =6.9x | |
| Goabode Iota All-in-one Security Kit Firmware | =6.9z |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-35886?
CVE-2022-35886 is a format string injection vulnerability that exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X.
How severe is CVE-2022-35886?
CVE-2022-35886 has a severity rating of 8.8, which is high.
What is the impact of CVE-2022-35886?
CVE-2022-35886 can lead to memory corruption, information disclosure, and denial of service.
How can CVE-2022-35886 be exploited?
CVE-2022-35886 can be exploited by sending a specially-crafted HTTP request.
Are there any fixes available for CVE-2022-35886?
At the moment, there is no information available regarding fixes for CVE-2022-35886. It is recommended to follow the guidance provided by the vendor or security advisory.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- vendor/goabode
- canonical/goabode iota all-in-one security kit firmware
- version/goabode iota all-in-one security kit firmware/6.9x
- version/goabode iota all-in-one security kit firmware/6.9z