CVE-2022-35886 - CVE House
Back to Database
Status published High CVE-2022-35886

Four format string injection vulnerabilities exist in the web interface...

Vulnerability Description

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` HTTP parameters, as used within the `/action/wirelessConnect` handler.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35886

Credits & Attribution

No credits recorded in the NVD database.

References

More from abode systems, inc.

View All →
CVE-2022-35887
Four format string injection vulnerabilities exist in the web interface...
High 8.2
CVE-2022-35885
Four format string injection vulnerabilities exist in the web interface...
High 8.2
CVE-2022-35884
Four format string injection vulnerabilities exist in the web interface...
High 8.2
CVE-2022-35881
Four format string injection vulnerabilities exist in the UPnP logging...
High 7.1
CVE-2022-35880
Four format string injection vulnerabilities exist in the UPnP logging...
High 7.1

Affected Vendor

abode systems, inc.

View all reports →

Affected Software

iota All-In-One Security Kit
Vulnerable Versions:
6.9X, 6.9Z

Timeline

Official Publish: October 25th, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-134

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.