CVE-2022-35886

🗓️ 25 Oct 2022 16:34:23Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 104 Views🌐 WEB

CVE-2022-35886 Four format string injection vulnerabilities exist in the web interface of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X, leading to memory corruption, information disclosure, and denial of service

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-35886	25 Oct 202220:26	–	circl
CNNVD	Abode Iota: Format string error vulnerability	20 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-35886	25 Oct 202216:34	–	cvelist
EUVD	EUVD-2022-38759	3 Oct 202520:07	–	euvd
NVD	CVE-2022-35886	25 Oct 202217:15	–	nvd
osv_cve	CVE-2022-35886	25 Oct 202217:15	–	osv_cve
Prion	Format string	25 Oct 202217:15	–	prion
Positive Technologies	PT-2022-22996 · Abode Systems · Iota All-In-One Security Kit	25 Oct 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-35886: Use of Externally-Controlled Format String	25 Oct 202200:00	–	rapid7
RedhatCVE	CVE-2022-35886	5 Feb 202518:50	–	redhatcve

NVD

Vulners

Node

goabode iota_all-in-one_security_kit_firmwareMatch6.9x

goabode iota_all-in-one_security_kit_firmwareMatch6.9z

[
  {
    "vendor": "abode systems, inc.",
    "product": "iota All-In-One Security Kit",
    "versions": [
      {
        "version": "6.9X",
        "status": "affected"
      },
      {
        "version": "6.9Z",
        "status": "affected"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2022-1585

Parameter	Position	Path	Description	CWE
default_key_id	query param	/action/wirelessConnect	Format string injection vulnerability in the default_key_id parameter within the /action/wirelessConnect handler.	CWE-134
key	query param	/action/wirelessConnect	Format string injection vulnerability in the key parameter within the /action/wirelessConnect handler.	CWE-134

17 Jun 2026 04:52Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

CVSS 38.2

EPSS0.01442

SSVC

CWE-134