ID
VAR-202210-1509
CVE
CVE-2022-35877
TITLE
Abode Systems, Inc. of Abode iota All-In-One Security Kit Format string vulnerability in firmware
Trust: 0.8
DESCRIPTION
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` configuration parameter, as used within the `testWifiAP` XCMD handler. Abode Systems, Inc. of Abode iota All-In-One Security Kit A format string vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Abode Iota is a solid DIY home security system from Abode Corporation
Trust: 2.25
AFFECTED PRODUCTS
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9z | Trust: 1.0 |
| vendor: | goabode | model: | iota all-in-one security kit | scope: | eq | version: | 6.9x | Trust: 1.0 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9x | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | abode iota all-in-one security kit firmware 6.9z | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | abode | model: | iota all-in-one security kit | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-134 | Trust: 1.0 |
| problemtype: | Format string problem (CWE-134) [ others ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
format string error
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-35877 | Trust: 3.3 |
| db: | TALOS | id: | TALOS-2022-1581 | Trust: 2.5 |
| db: | JVNDB | id: | JVNDB-2022-019025 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202210-2079 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-432123 | Trust: 0.1 |
REFERENCES
| url: | https://talosintelligence.com/vulnerability_reports/talos-2022-1581 | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-35877 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-35877/ | Trust: 0.6 |
SOURCES
| db: | VULHUB | id: | VHN-432123 |
| db: | JVNDB | id: | JVNDB-2022-019025 |
| db: | CNNVD | id: | CNNVD-202210-2079 |
| db: | NVD | id: | CVE-2022-35877 |
LAST UPDATE DATE
2024-08-14T14:10:31.068000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-432123 | date: | 2022-10-28T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019025 | date: | 2023-10-24T05:46:00 |
| db: | CNNVD | id: | CNNVD-202210-2079 | date: | 2022-10-31T00:00:00 |
| db: | NVD | id: | CVE-2022-35877 | date: | 2022-10-28T01:28:27.337 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-432123 | date: | 2022-10-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-019025 | date: | 2023-10-24T00:00:00 |
| db: | CNNVD | id: | CNNVD-202210-2079 | date: | 2022-10-25T00:00:00 |
| db: | NVD | id: | CVE-2022-35877 | date: | 2022-10-25T17:15:54.680 |