Format String Injection Vulnerabilities in Abode Systems Security Kit

CVE-2022-35886

Summary

Abode Systems, Inc. has identified multiple format string injection vulnerabilities within the web interface functionality of its iota All-In-One Security Kit, specifically in the '/action/wirelessConnect' endpoint. By sending specially-crafted HTTP requests utilizing the 'default_key_id' and 'key' parameters, an attacker can trigger memory corruption issues, leading to potential information disclosure and denial of service incidents. These vulnerabilities require the attacker to authenticate prior to exploitation, underscoring the importance of securing the web interface to prevent unauthorized access.

References