CVE-2022-35879
- Reference to the description:
- Description:
- Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `controlURL` XML tag, as used within the `DoUpdateUPnPbyService` action handler.
- Last updated date:
- 10/27/2022
- Type:
- exploit
- Confidence:
- HIGH
- Date of publishing:
- 10/27/2022
- Reference url to background
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1583