Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the default_key_id configuration parameter, as used within the testWifiAP XCMD handler
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Iota_all-in-one_security_kit_firmware | Goabode | 6.9x (including) | 6.9x (including) |
| Iota_all-in-one_security_kit_firmware | Goabode | 6.9z (including) | 6.9z (including) |