CVE-2022-35885

Vulnerability

Four format string injection vulnerabilities exist in the /action/wirelessConnect functionality of Abode Systems iota All-In-One Security Kit versions 6.9Z and 6.9X. The vulnerability is triggered via the wpapsk_hex HTTP parameter, which is passed to a format string function (log) that wraps vsnprintf, allowing an attacker to inject format specifiers [1].

Exploitation

An attacker must be authenticated to the device and send a specially-crafted HTTP POST request to /action/wirelessConnect with a malicious format string payload in the wpapsk_hex parameter. No user interaction is required beyond authentication [1].

Impact

Successful exploitation can lead to memory corruption, information disclosure (e.g., stack memory leak), and denial of service. The attacker may gain the ability to write arbitrary memory, potentially leading to further compromise [1].

Mitigation

No official fix has been released as of the publication date (2022-10-25). Users should monitor vendor advisories for updates. The affected versions are 6.9Z and 6.9X [1].