Format String Injection Vulnerability in Abode Systems iota All-In-One Security Kit

CVE-2022-33938

Summary

A format string injection vulnerability exists within the ghome_process_control_packet feature of the iota All-In-One Security Kit produced by Abode Systems, Inc. This vulnerability can be exploited through specially crafted XML payloads that utilize the XCMD mechanism, potentially leading to serious consequences including memory corruption, information disclosure, and denial of service events. Attackers may exploit this flaw by sending malicious input to the affected devices, compromising their operational integrity.

References