CVE-2017-16342

CVE-2017-16342 affects Insteon Hub firmware 1012 and is a buffer overflow in the PubNub/JSON command handling path. The vulnerability occurs when processing a s_sonos command with the s_vol_dim_delta field: the code copies the string with strcpy into a 4-byte buffer at 0xa0000514, allowing overfl...

CVE-2017-16343

CVE-2017-16343 affects Insteon Hub firmware 1012, where a strcpy-based overflow targets a small buffer used for s_vol_brt_delta when handling PubNub/HTTP JSON commands. The described access pattern copies a 4-byte buffer into a RAM location (global_s_vol at 0xa0001700) via an unconstrained src fo...

CVE-2017-16339

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer...

CVE-2017-14444

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

CVE-2018-3834

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going t...

CVE-2017-16346

CVE-2017-16346 affects Insteon Hub firmware 1012. A path through the PubNub/JSON message handler can copy strings with strcpy into a 25-byte buffer for s_mac (buf at 0xa000170c), enabling a global RAM overflow when the input exceeds the limit. The vulnerable flow occurs during processing of the s...

CVE-2017-16343

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c284 the value for the svolbrtdelta key is copied using strcpy to the buffer at 0xa0000510. This buffer is 4 bytes large, sending anything longer will cause a...

PT-2018-6272 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the value for the s vol brt delta key is copied using strcpy to a buffer at address 0xa000051...

PT-2018-5647 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A stack-based buffer overflow issue exists due to the HTTP server implementation unsafely extracting parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HT...

PT-2018-6268 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, at memory address 0x9d01bb1c, the value for the uri key is copied using strcpy to a buffer at...

PT-2018-6273 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: An attacker could send an authenticated HTTP request to trigger this issue in Insteon Hub. The value for the s url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, an...

PT-2018-6274 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger it. Specifically, it involves copying the value for the s port key to a buffer using strcpy. This buffer has a size of 6 bytes...

PT-2018-6276 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: An attacker could send an authenticated HTTP request to trigger this issue in Insteon Hub. The value for the s vol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes...

PT-2018-6269 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, at memory address 0x9d01c0e8, the value for the s dport key is copied using strcpy to a buffe...

PT-2018-6271 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the value for the s vol dim delta key is copied using strcpy to a buffer at address 0xa000051...

PT-2018-16228 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1013 Description: An exploitable permanent denial of service issue exists due to the firmware upgrade functionality retrieving signed firmware binaries using plain HTTP requests. The device does not check the type of...

CVE-2017-16341: Buffer Copy without Checking Size of Input

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c224 the value for the svolplay key is copied using strcpy to the buffer at 0xa0000418. This buffer is maximum 8 bytes large this is the maximum size it could...

CVE-2017-16347: Buffer Copy without Checking Size of Input

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the svol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large this is the maximum size it could be,...

CVE-2017-16344: Buffer Copy without Checking Size of Input

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c2c8 the value for the surl key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, sending anything longer will cause a buffer...

PT-2018-6267 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. This occurs because the value for the host key is copied using strcpy to a buffer at 0xa00016e0, which is 3...