A vulnerability classified as critical has been found in Abode iota All-In-One Security Kit 6.9X/6.9Z. This affects the function testWifiAP of the component XCMD Handler. The manipulation of the argument default_key_id/key with an unknown input leads to a format string vulnerability. CWE is classifying the issue as CWE-134. The software uses a function that accepts a format string as an argument, but the format string originates from an external source. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` configuration parameters, as used within the `testWifiAP` XCMD handler

The weakness was presented 10/25/2022 as TALOS-2022-1581. The advisory is shared at talosintelligence.com. This vulnerability is uniquely identified as CVE-2022-35876 since 07/15/2022. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/25/2022).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• Abode

Name

• iota All-In-One Security Kit

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion