Use of Externally-Controlled Format String
CWE-134
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
We track 111 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.4. 5 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Choose a language that is not subject to this flaw.
- Implementation: Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings.
- Build and Compilation: Run compilers and linkers with high warning levels, since they may detect incorrect usage.
Latest Use of Externally-Controlled Format String vulnerabilities
- 7.8 High severity
FortiProxy: Use of Externally-Controlled Format String
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows at
- 9.8 Critical severity
SCADA Data Gateway: Use of Externally-Controlled Format String
On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user
- 7.8 High severity
Samsung Mobile Devices: Use of Externally-Controlled Format String
Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the memory address.
- 8.8 High severity
XClarity Controller: Use of Externally-Controlled Format String
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
- 7.8 High severity
FortiWeb: Use of Externally-Controlled Format String
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.
- 8.5 High severity
BIG-IP: Use of Externally-Controlled Format String
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attack
- 9.8 Critical severity
sslh: Use of Externally-Controlled Format String
A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclos
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
- 8.8 High severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of se
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial o
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attac
- 9.8 Critical severity
iota All-In-One Security Kit: Use of Externally-Controlled Format String
A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of ser
- 8.1 High severity
Baxter Spectrum Wireless Battery Module (WBM): Use of Externally-Controlled Format String
The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.
- 9.8 Critical severity
Zyxel NAS326 firmware: Use of Externally-Controlled Format String
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.
- 7.8 High severity
Fortinet FortiADC, FortiProxy, FortiMail…: Use of Externally-Controlled Format String
A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 throug
- 7.5 High severity
HarmonyOS: Use of Externally-Controlled Format String
The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
RT-AX88U: Use of Externally-Controlled Format String
ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.
- 7.8 High severity
MariaDB: Use of Externally-Controlled Format String
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw
- 5.5 Medium severity
Samsung Mobile Devices Improper Input Validation Exploited
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
- 8.8 High severity
Cisco IOS XR Software Discovery Protocol Format String Exploited
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of str
- 8.1 High severity
Palo Alto Networks PAN-OS Remote Code Execution Exploited
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
- 8.0 High severity
Cisco IOS, XR, and XE Software Buffer Overflow Exploited
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute