Format String Injection Vulnerabilities in Abode iota All-In-One Security Kit

CVE-2022-35881

Summary

Multiple format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems' iota All-In-One Security Kit (versions 6.9Z and 6.9X). These vulnerabilities can be exploited through specially-crafted UPnP negotiations, potentially resulting in memory corruption, information leakage, and denial of service. Attackers may host a malicious UPnP service to exploit these weaknesses, specifically targeting the handling of errorCode and errorDescription XML tags within the DoUpdateUPnPbyService action. This security flaw highlights the need for robust sanitization practices to prevent malicious UPnP requests.

References