ID
VAR-202210-1391
CVE
CVE-2022-35881
TITLE
Abode Systems, Inc. of Abode iota All-In-One Security Kit Format string vulnerability in firmware
Trust: 0.8
DESCRIPTION
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `errorCode` and `errorDescription` XML tags, as used within the `DoUpdateUPnPbyService` action handler. Abode Systems, Inc. of Abode iota All-In-One Security Kit A format string vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Abode Iota is a solid DIY home security system from Abode Corporation
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9z | Trust: 1.0 |
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9x | Trust: 1.0 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9z | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9x | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-134 | Trust: 1.0 |
| problemtype: | Format string problem (CWE-134) [ others ] | Trust: 0.8 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
format string error
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-35881 | Trust: 3.3 |
| db: | TALOS | id: | TALOS-2022-1583 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2022-019827 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202210-1494 | Trust: 0.7 |
| db: | VULHUB | id: | VHN-429590 | Trust: 0.1 |
REFERENCES
| url: | https://talosintelligence.com/vulnerability_reports/talos-2022-1583 | Trust: 3.1 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-35881 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-35881/ | Trust: 0.6 |
CREDITS
Discovered by Matt Wiseman of Cisco Talos.
Trust: 0.6
SOURCES
| db: | VULHUB | id: | VHN-429590 |
| db: | JVNDB | id: | JVNDB-2022-019827 |
| db: | CNNVD | id: | CNNVD-202210-1494 |
| db: | NVD | id: | CVE-2022-35881 |
LAST UPDATE DATE
2024-08-14T14:02:18.882000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-429590 | date: | 2022-10-27T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019827 | date: | 2023-10-27T08:13:00 |
| db: | CNNVD | id: | CNNVD-202210-1494 | date: | 2022-10-31T00:00:00 |
| db: | NVD | id: | CVE-2022-35881 | date: | 2022-10-27T15:58:49.897 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-429590 | date: | 2022-10-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019827 | date: | 2023-10-27T00:00:00 |
| db: | CNNVD | id: | CNNVD-202210-1494 | date: | 2022-10-20T00:00:00 |
| db: | NVD | id: | CVE-2022-35881 | date: | 2022-10-25T17:15:54.903 |