Format String Injection Vulnerabilities in Abode Systems' iota All-In-One Security Kit

CVE-2022-35878

Summary

The Abode Systems iota All-In-One Security Kit contains multiple vulnerabilities that can be exploited through format string injection. These vulnerabilities are primarily associated with the UPnP logging feature, where specially crafted UPnP responses can lead to significant security risks including memory corruption, exposure of sensitive information, and potential denial of service operations. Attackers could deploy a malicious UPnP service to exploit these weaknesses by manipulating the 'ST' and 'Location' HTTP response headers during interaction with the DoEnumUPnPService action handler.

References