CVE-2017-16337
published 2018-08-23CVE-2017-16337: On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.69%
74.2th percentile
On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. At 0x9d01ef24 the value for the s_offset key is copied using strcpy to the buffer at $sp+0x2b0. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| insteon | hub_2245-222_firmware | — | — |
| insteon | insteon_hub_2245-222 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
blogs_talos·2018-06-19·CVSS 8.1
[HIGH] Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
## Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
Vulnerabilities discovered by Claudio Bozzato of Cisco Talos
Talos is disclosing twelve new vulnerabilities in Insteon Hub, ranging from remote code execution, to denial of service. The majority of the vulnerabilities have their root cause in the unsafe usage of the strcpy() function, leading either to stack overflow or global overflow.
## Overview
Insteon Hub is a central controller, which allows an end user to use a smartphone to connect to and manage devices in their home remotely. To enable remote interaction via the internet, Insteon Hub uses an online service called PubNub.
End users install the "Insteon for Hub" application on their smartphone. Both the smartphone application and Insteon Hub inclu
Talos
Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
blogs_talos·2018-06-19·CVSS 8.1
[HIGH] Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub PubNub
Vulnerabilities discovered by Claudio Bozzato of Cisco Talos
Talos is disclosing twelve new vulnerabilities in Insteon Hub, ranging from remote code execution, to denial of service. The majority of the vulnerabilities have their root cause in the unsafe usage of the strcpy() function, leading either to stack overflow or global overflow.
### Overview
Insteon Hub is a central controller, which allows an end user to use a smartphone to connect to and manage devices in their home remotely. To enable remote interaction via the internet, Insteon Hub uses an online service called PubNub.
End users install the "Insteon for Hub" application on their smartphone. Both the smartphone application and Insteon Hub include the PubNub software development kit, which allows for bidirectional communicati
2018-08-23
Published