Vulnerability · Published Oct 25, 2022 · Assigned by talos

CVE-2022-35885

High 8.2

In plain English

A high-severity security flaw in iota All-In-One Security Kit from abode systems, inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.0)8.2High

Exploit odds (30 days)1.4%top 26.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.

Affected products (as reported)

Vendor	Product	Versions
abode systems, inc.	iota All-In-One Security Kit	6.9X6.9Z

Weakness: CWE-134 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585