CVE-2022-35886

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z through 6.9X

Description The web interface /action/wirelessConnect functionality contains format string injection vulnerabilities. A specially-crafted HTTP request can lead to memory corruption, information disclosure, and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities via the default key id and key HTTP parameters within the /action/wirelessConnect handler.

Recommendations For versions 6.9Z through 6.9X, consider disabling the /action/wirelessConnect functionality until a patch is available to prevent exploitation through the default key id and key parameters. Restrict access to the /action/wirelessConnect handler to minimize the risk of exploitation. Avoid using the default key id and key parameters in the affected API endpoint until the issue is resolved.