Format String Injection Vulnerabilities in Abode Systems iota Security Kit

CVE-2022-35880

Summary

Multiple vulnerabilities related to format string injection have been identified in the UPnP logging functionality of Abode Systems' iota All-In-One Security Kit models 6.9Z and 6.9X. An attacker can exploit these vulnerabilities by hosting a malicious UPnP service, potentially leading to memory corruption, unauthorized information disclosure, and denial of service. These risks arise from specific interactions within the NewInternalClient XML tag utilized in the DoUpdateUPnPbyService action handler, highlighting the importance of securing UPnP functionality against crafted negotiation attempts.

References