CVE-2022-35885

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585	Exploit Technical Description Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:::::::*
	cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:::::::*

History

21 Nov 2024, 07:11

Type	Values Removed	Values Added
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585 - Exploit, Technical Description, Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585 - Exploit, Technical Description, Third Party Advisory

Information

Published : 2022-10-25 17:15

Updated : 2024-11-21 07:11

NVD link : CVE-2022-35885

Mitre link : CVE-2022-35885

CVE.ORG link : CVE-2022-35885

JSON object : View

Products Affected

goabode

iota_all-in-one_security_kit_firmware

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2022-35885", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-10-25T17:15:55.017", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler."}, {"lang": "es", "value": "Se presentan cuatro vulnerabilidades de inyecci\u00f3n de cadenas de formato en la funcionalidad de la interfaz web /action/wirelessConnect de Abode Systems, Inc. iota All-In-One Security Kit versiones 6.9Z y 6.9X. Una petici\u00f3n HTTP especialmente dise\u00f1ada puede conllevar a una corrupci\u00f3n de memoria, divulgaci\u00f3n de informaci\u00f3n y denegaci\u00f3n de servicio. Un atacante puede realizar una petici\u00f3n HTTP autenticada para desencadenar estas vulnerabilidades. Esta vulnerabilidad surge de una inyecci\u00f3n de cadenas de formato por medio del par\u00e1metro HTTP \"wpapsk_hex\", usado dentro del manejador \"/action/wirelessConnect\""}], "lastModified": "2024-11-21T07:11:52.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9341C371-6AC1-428C-809E-7856975E8FC3"}, {"criteria": "cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA9202A4-4D07-4293-93EE-73183AEEE5E0"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}