CVE-2022-35887

Name of the Vulnerable Software and Affected Versions Abode Systems, Inc. iota All-In-One Security Kit versions 6.9Z and 6.9X

Description The issue arises from format string injection via the default key id HTTP parameter in the /action/wirelessConnect handler. A specially-crafted HTTP request can lead to memory corruption, information disclosure, and denial of service. An attacker can make an authenticated HTTP request to trigger this issue.

Recommendations For versions 6.9Z and 6.9X, consider restricting access to the /action/wirelessConnect API endpoint until a patch is available. As a temporary workaround, avoid using the default key id parameter in the affected API endpoint until the issue is resolved.