TI-2022-16315 Aliases CVE-2022-35884 GHSA-62mf-g244-32xg

Four format string injection vulnerabilities exist in the web interface…

HIGH 77CWE-134Published 2022-10-25 · Updated 2025-04-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.

Summary

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01442 73rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
abode systems, inc.	iota All-In-One Security Kit	6.9X; 6.9Z	—	No fix listed	CNA

iota All-In-One Security Kit Vendorabode systems, inc. Affected 6.9X; 6.9Z Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:::::::*	6.9x	Vulnerable	abode systems, inc.
cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:::::::*	6.9z	Vulnerable	abode systems, inc.

cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9x:*:*:*:*:*:*:* Versions 6.9x Vulnerable ·abode systems, inc.
cpe:2.3:o:goabode:iota_all-in-one_security_kit_firmware:6.9z:*:*:*:*:*:*:* Versions 6.9z Vulnerable ·abode systems, inc.

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-35884
2026-10-03 Alias added: GHSA-62mf-g244-32xg

References

Exploit 1

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585

TI-2022-15924 A format string injection vulnerability exists in the XCMD getVarHA functionality of… CVSS 3.1CRITICAL 9.8
TI-2022-14636 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14635 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14634 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14633 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 9.9
TI-2022-14627 OS command injection in abode systems, inc. iota All-In-One Security Kit CVSS 3.1CRITICAL 10.0

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences