CVE-2022-35877

Abode Systems iota All-In-One Security Kit (versions 6.9X and 6.9Z) contains four format string injection flaws in the XCMD handler testWifiAP, caused by improper handling of the default_key_id configuration parameter. This leads to memory corruption, information disclosure, and denial of service...

CVE-2022-35877

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35877

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35876

Four format-string injection vulnerabilities exist in Abode Systems, Inc. iota All-In-One Security Kit (firmware 6.9X/6.9Z) within the XCMD testWifiAP path. The root cause is usage of attacker-controlled configuration values (default_key_id and key) in log/command construction for Wi‑Fi setup, en...

CVE-2022-35876

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35875

Abode Systems, Inc. iota All-In-One Security Kit (versions 6.9X and 6.9Z) exposes four format-string injection flaws in the testWifiAP XCMD handler. The root cause is improper use of format strings when logging commands constructed from attacker-supplied Wi‑Fi configuration values (ssid/ssid_hex,...

CVE-2022-35875

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35875

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35874

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a...

CVE-2022-35874

The CVE-2022-35874 vulnerability affects Abode Systems iota All-In-One Security Kit (versions 6.9X and 6.9Z). It consists of four format string injection flaws in the XCMD testWifiAP handler, originating from ssid and ssid_hex configuration parameters, leading to memory corruption, information di...

CVE-2022-35244

CVE-2022-35244 : A format string injection vulnerability affects Abode Systems iota All-In-One Security Kit (versions 6.9X and 6.9Z) in the XCMD getVarHA function. The issue can cause memory corruption, information disclosure, and denial of service when a specially crafted XML payload is processe...

CVE-2022-35244

A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attacker can send a malicious XML payload ...

CVE-2022-33938

The CVE-2022-33938 entry concerns Abode Systems iota All-In-One Security Kit, affected in versions 6.9Z and 6.9X. The concrete issue is a format-string injection in the ghome_process_control_packet function, triggered by a crafted XML payload sent to the device, which can cause memory corruption,...

CVE-2022-33938

A format string injection vulnerability exists in the ghomeprocesscontrolpacket functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of service. An attacker can send a malicious X...

CVE-2022-33938

A format string injection vulnerability exists in the ghomeprocesscontrolpacket functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of service. An attacker can send a malicious X...

CVE-2022-33207

Abode iota All-In-One Security Kit (firmware 6.9X/6.9Z) is affected by CVE-2022-33207 through the /action/wirelessConnect web interface. The root cause is OS command injection due to unsanitized default_key_id usage when the authentication mode is SHARED or WEP; the command is executed as root vi...

CVE-2022-33207

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP reque...

CVE-2022-33206

CVE-2022-33206 affects Abode iota All-In-One Security Kit firmware 6.9X/6.9Z. The vulnerability lies in web interface /action/wirelessConnect: when WL_Enable is on, an authenticated HTTP POST can craft commands via parameters like ssid/ssid_hex, auth_mode, wpapsk/wpapsk_hex, encryp_type, key, and...

CVE-2022-33206

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP reque...

CVE-2022-33206

Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP reque...