CVE-2022-35880

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z through 6.9X

Description Four format string injection issues exist in the UPnP logging functionality. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these issues. This arises from format string injection via NewInternalClient XML tag, as used within the DoUpdateUPnPbyService action handler.

Recommendations For versions 6.9Z and 6.9X, consider disabling the DoUpdateUPnPbyService action handler as a temporary workaround until a patch is available. Restrict access to the UPnP logging functionality to minimize the risk of exploitation. Avoid using the NewInternalClient XML tag in the affected UPnP negotiation until the issue is resolved.