Format String Injection in Abode Systems iota All-In-One Security Kit

CVE-2022-35884

Summary

Abode Systems iota All-In-One Security Kit is susceptible to four format string injection vulnerabilities affecting the /action/wirelessConnect functionality. Attackers can exploit these vulnerabilities by sending specially-crafted HTTP requests, potentially resulting in memory corruption, unauthorized information disclosure, and denial of service. The vulnerabilities arise from improper handling of the 'ssid_hex' HTTP parameter within the wireless connection handler, allowing authenticated users to trigger these critical weaknesses.

References