Format String Injection Vulnerabilities in Abode Systems iota All-In-One Security Kit

CVE-2022-35879

Summary

The iota All-In-One Security Kit from Abode Systems contains multiple vulnerabilities related to format string injection in its UPnP logging feature. These vulnerabilities can be exploited by an attacker through a carefully crafted UPnP negotiation, leading to potential memory corruption, information disclosure, or denial of service. Specifically, exploitation occurs via the controlURL XML tag within the DoUpdateUPnPbyService action handler, allowing attackers to host a malicious UPnP service that triggers these vulnerabilities.

References