CVE-2017-16340

CVE-2017-16340 affects Insteon Hub firmware 1012. The vulnerability is caused by unsafely copying the s_dport value via strcpy into a 6-byte buffer during PubNub JSON handling (cmd s_sonos), enabling a global RAM overflow. Exploitation requires an authenticated PubNub/HTTP request. Talos notes fi...

CVE-2017-16340

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the sdport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer...