CVE-2017-14445
published 2018-08-02CVE-2017-14445: An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host…
PriorityP354critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.12%
62.0th percentile
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| insteon | hub_firmware | — | — |
| insteon | insteon | — | — |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
nvdv2.08.0HIGHAV:N/AC:L/Au:S/C:P/I:P/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
blogs_talos·2018-06-19·CVSS 8.1
[HIGH] Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
## Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
Vulnerabilities discovered by Claudio Bozzato of Cisco Talos
Talos is disclosing twelve new vulnerabilities in Insteon Hub, ranging from remote code execution, to denial of service. The majority of the vulnerabilities have their root cause in the unsafe usage of the strcpy() function, leading either to stack overflow or global overflow.
## Overview
Insteon Hub is a central controller, which allows an end user to use a smartphone to connect to and manage devices in their home remotely. To enable remote interaction via the internet, Insteon Hub uses an online service called PubNub.
End users install the "Insteon for Hub" application on their smartphone. Both the smartphone application and Insteon Hub inclu
Talos
Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
blogs_talos·2018-06-19·CVSS 8.1
[HIGH] Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
Vulnerabilities discovered by Claudio Bozzato of Cisco Talos
Talos is disclosing twelve new vulnerabilities in Insteon Hub, ranging from remote code execution, to denial of service. The majority of the vulnerabilities have their root cause in the unsafe usage of the strcpy() function, leading either to stack overflow or global overflow.
### Overview
Insteon Hub is a central controller, which allows an end user to use a smartphone to connect to and manage devices in their home remotely. To enable remote interaction via the internet, Insteon Hub uses an online service called PubNub.
End users install the "Insteon for Hub" application on their smartphone. Both the smartphone application and Insteon Hub include the PubNub software development kit, which allows for bidirectional communicati
2018-08-02
Published