Cyber Resilience

CVE-2022-35887

HighPublic PoC

Published: 25 October 2022

Published
25 October 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0157 82.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-35887 is a high-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Goabode Iota All-In-One Security Kit Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 18.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker…

more

can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` HTTP parameter, as used within the `/action/wirelessConnect` handler.

CWE(s)
CWE-134

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

goabode
iota all-in-one security kit firmware
6.9x, 6.9z

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References