Fiche vulnérabilité
CVE-2022-35878 : faille élevée abode systems, inc. iota All-In-One… (CVSS 7.1)
Description
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `ST` and `Location` HTTP response headers, as used within the `DoEnumUPnPService` action handler.
En bref
- Sévérité
- Élevée (CVSS 7.1)
- Vecteur CVSS
- CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Exploitation active
- Non signalée par la CISA
- Publication
- 25 oct. 2022
- Dernière mise à jour
- 15 avr. 2025
Produits concernés
- abode systems, inc. iota All-In-One Security Kit