CVE-2022-35881

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z and 6.9X

Description The issue arises from format string injection vulnerabilities in the UPnP logging functionality. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities, which occur via errorCode and errorDescription XML tags within the DoUpdateUPnPbyService action handler.

Recommendations For versions 6.9Z and 6.9X, consider disabling the DoUpdateUPnPbyService action handler as a temporary workaround to minimize the risk of exploitation. Restrict access to the UPnP logging functionality to prevent malicious UPnP negotiations. Avoid using the errorCode and errorDescription XML tags in the affected UPnP service until the issue is resolved.