PT-2022-22995
CVE-2022-35885
·
تاريخ النشر
2022-10-25
·
تاريخ التحديث
2022-10-27
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z and 6.9X
Description
The issue arises from format string injection via the
wpapsk hex HTTP parameter in the /action/wirelessConnect handler. A specially-crafted HTTP request can lead to memory corruption, information disclosure, and denial of service. An attacker can make an authenticated HTTP request to trigger this issue.Recommendations
For versions 6.9Z and 6.9X, avoid using the
wpapsk hex parameter in the /action/wirelessConnect endpoint until a fix is available. As a temporary workaround, consider restricting access to the /action/wirelessConnect functionality to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾