CVE Published: 25/10/2022 |
CVE Updated: 17/09/2024 |
CVE Year: 2022 Source: talos |
Vendor: abode systems, inc. |
Product: iota All-In-One Security Kit Status : PUBLISHED
CVE-2022-35881 Description
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `errorCode` and `errorDescription` XML tags, as used within the `DoUpdateUPnPbyService` action handler.