CVE-2022-35876

Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` configuration parameters, as used within the `testWifiAP` XCMD handler

• CWE-134

• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581Exploit, Technical Description, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581Exploit, Technical Description, Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35870This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-35871This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-35872This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-35873This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-35874Four format string injection vulnerabilities exist in the XC…9.8
• CVE-2022-35875Four format string injection vulnerabilities exist in the XC…9.8
• CVE-2022-35877Four format string injection vulnerabilities exist in the XC…9.8
• CVE-2022-35878Four format string injection vulnerabilities exist in the UP…8.8
• CVE-2022-35879Four format string injection vulnerabilities exist in the UP…8.8
• CVE-2022-35880Four format string injection vulnerabilities exist in the UP…8.8
• CVE-2022-35881Four format string injection vulnerabilities exist in the UP…8.8
• CVE-2022-35882Authenticated (author or higher user role) Stored Cross-Site…4.8