CVE-2022-35885 details four format string injection vulnerabilities in the web interface of Abode Systems iota All-In-One Security Kit firmware versions 6.9Z and 6.9X. An authenticated attacker can exploit these flaws by sending a specially crafted HTTP request to the /action/wirelessConnect functionality, specifically manipulating the wpapsk_hex parameter. This can lead to severe consequences including memory corruption, information disclosure, and denial of service, as reflected by its CVSS score of 8.8 (High). Despite its high severity, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is it listed on CISA's KEV catalog, indicating no active exploitation. Community discussion and media coverage for this CVE are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.9xCPE matchmatch criteria | cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:*:*:*:*:*:*:* | ||
6.9zCPE matchmatch criteria | cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.