CVE-2017-16339

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer...

CVE-2017-16342

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c254 the value for the svoldimdelta key is copied using strcpy to the buffer at 0xa0000514. This buffer is 4 bytes large, sending anything longer will cause a...

CVE-2017-16343

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c284 the value for the svolbrtdelta key is copied using strcpy to the buffer at 0xa0000510. This buffer is 4 bytes large, sending anything longer will cause a...

CVE-2017-16342

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c254 the value for the svoldimdelta key is copied using strcpy to the buffer at 0xa0000514. This buffer is 4 bytes large, sending anything longer will cause a...

CVE-2017-16347

CVE-2017-16347 affects Insteon Hub firmware 1012 via the PubNub Pub/Sub message handler on channel cc. The vulnerability arises when handling JSON requests (cmd/ sn_sonos_cmd/ s_vol) where the code copies values with strcpy into small buffers and a subsequent write targets a global buffer at 0xa0...

CVE-2017-16344

CVE-2017-16344 affects Insteon Hub (firmware 1012, version 2245-222) via PubNub-based JSON handling. The s_url field (and related keys) is copied with strcpy into a 16-byte global buffer at 0xa0001a0c, enabling a global RAM overflow. The vulnerability is triggered by authenticated HTTP requests t...

CVE-2017-16338

CVE-2017-16338 affects Insteon Hub firmware 1012. The PubNub message handler uses strcpy on various JSON fields, overflowing buffers in a global RAM region (e.g., host, sn_sonos_cmd, s_vol, etc.). This can overwrite global data and, per Talos, enables remote code execution via authenticated PubNu...

CVE-2017-16344

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c2c8 the value for the surl key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, sending anything longer will cause a buffer...

CVE-2017-14446

CVE-2017-14446 affects Insteon Hub firmware 1012. The HTTP server’s HTTPExecuteGet extracts GET parameters into a small local array (room for 5 pointers) without enforcing a limit, so supplying more than 4 parameters overruns the stack and can overwrite return/register state. Exploitation demonst...

CVE-2017-16340

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the sdport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-16345

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c318 the value for the sport key is copied using strcpy to the buffer at 0xa00017f4. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-16339

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer...

CVE-2017-14445

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

CVE-2017-16346

CVE-2017-16346 affects Insteon Hub firmware 1012. A path through the PubNub/JSON message handler can copy strings with strcpy into a 25-byte buffer for s_mac (buf at 0xa000170c), enabling a global RAM overflow when the input exceeds the limit. The vulnerable flow occurs during processing of the s...

CVE-2017-16342

CVE-2017-16342 affects Insteon Hub firmware 1012 and is a buffer overflow in the PubNub/JSON command handling path. The vulnerability occurs when processing a s_sonos command with the s_vol_dim_delta field: the code copies the string with strcpy into a 4-byte buffer at 0xa0000514, allowing overfl...

CVE-2017-16346

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the smac key is copied using strcpy to the buffer at 0xa000170c. This buffer is 25 bytes large, sending anything longer will cause a buffer...

CVE-2017-16347

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the svol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large this is the maximum size it could be,...

CVE-2017-16339

CVE-2017-16339 affects Insteon Hub (firmware 1012). A buffer overflow occurs when the uri field is copied via strcpy into a 64-byte buffer at 0xa00016a0 during an authenticated HTTP request (UpdateCheck path). This can overflow the global RAM area and potentially lead to arbitrary data overwrite....

CVE-2017-16343

CVE-2017-16343 affects Insteon Hub firmware 1012, where a strcpy-based overflow targets a small buffer used for s_vol_brt_delta when handling PubNub/HTTP JSON commands. The described access pattern copies a 4-byte buffer into a RAM location (global_s_vol at 0xa0001700) via an unconstrained src fo...

CVE-2017-16340

CVE-2017-16340 affects Insteon Hub firmware 1012. The vulnerability is caused by unsafely copying the s_dport value via strcpy into a 6-byte buffer during PubNub JSON handling (cmd s_sonos), enabling a global RAM overflow. Exploitation requires an authenticated PubNub/HTTP request. Talos notes fi...