CVE-2022-35887
First published: Tue Oct 25 2022(Updated: )
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` HTTP parameter, as used within the `/action/wirelessConnect` handler.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Goabode Iota All-in-one Security Kit Firmware | =6.9x | |
| Goabode Iota All-in-one Security Kit Firmware | =6.9z |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-35887?
CVE-2022-35887 is a vulnerability in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X, which allows for format string injection.
What is the severity of CVE-2022-35887?
CVE-2022-35887 has a severity score of 8.8, indicating a high severity vulnerability.
How does CVE-2022-35887 impact the system?
CVE-2022-35887 can lead to memory corruption, information disclosure, and denial of service when a specially-crafted HTTP request is sent.
Which software versions are affected by CVE-2022-35887?
The affected software versions of CVE-2022-35887 are Goabode Iota All-in-one Security Kit Firmware 6.9X and 6.9Z.
Is there a fix available for CVE-2022-35887?
At the time of writing, there is no known fix or patch available for CVE-2022-35887. It is recommended to follow the vendor's security advisory for updates.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/goabode
- canonical/goabode iota all-in-one security kit firmware
- version/goabode iota all-in-one security kit firmware/6.9x
- version/goabode iota all-in-one security kit firmware/6.9z