high8.8
CVE-2022-35879
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc.
Impact
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `controlURL` XML tag, as used within the `DoUpdateUPnPbyService` action handler.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Goabode | Iota All-In-One Security Kit Firmware | Versions 6.9x, 6.9z |