CVE-2013-4859

published 2019-12-27

CVE-2013-4859: INSTEON Hub 2242-222 lacks Web and API authentication

Priority P2 65 high 8.1 CVSS 3.1

AV N AC H PR N UI N S U C H I H A H

EXPLOIT

INSTEON Hub 2242-222 lacks Web and API authentication

Affected

1 ranges

Vendor	Product	Version range	Fixed in
insteon	hub_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3↗

url http://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3↗

url http://A.B.C.D:8001/buffstatus.xml↗

port 8001↗

path /buffstatus.xml↗

• → Detect unauthenticated HTTP GET requests to port 8001 targeting the INSTEON Hub ON command path pattern /3?0262[A-F0-9]{6}0F11FF=I=3 ↗
• → Detect unauthenticated HTTP GET requests to port 8001 targeting the INSTEON Hub OFF command path pattern /3?0262[A-F0-9]{6}0F1100=I=3 ↗
• → Detect unauthenticated HTTP GET requests to /buffstatus.xml on port 8001; successful responses expose recently used INSTEON device IDs that can be replayed for device control ↗
• → Monitor for any HTTP traffic to/from port 8001 on Internet-facing hosts; the hub requires a port forward from the Internet and all control commands are unauthenticated plaintext GET requests ↗
• → The device does not support SSL/TLS; all commands including any credentials are transmitted in cleartext and are susceptible to capture and replay — flag unencrypted HTTP sessions on port 8001 containing INSTEON command strings ↗

• · The vulnerability only manifests if the user has NOT configured a username and password on the hub; if credentials are set the anonymous access path is blocked ↗
• · Exploitation requires the hub to be reachable from the Internet via a port-forward; devices not port-forwarded are only exposed on the local network ↗
• · Only model 2242-222 is affected; the replacement model 2422-222R is confirmed not vulnerable ↗

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-276