CVE-2017-16345

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c318 the value for the sport key is copied using strcpy to the buffer at 0xa00017f4. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-16347

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the svol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large this is the maximum size it could be,...

CVE-2017-16340

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the sdport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-16339

CVE-2017-16339 affects Insteon Hub (firmware 1012). A buffer overflow occurs when the uri field is copied via strcpy into a 64-byte buffer at 0xa00016a0 during an authenticated HTTP request (UpdateCheck path). This can overflow the global RAM area and potentially lead to arbitrary data overwrite....

CVE-2017-16339

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer...

CVE-2017-14445

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

CVE-2017-16343

CVE-2017-16343 affects Insteon Hub firmware 1012, where a strcpy-based overflow targets a small buffer used for s_vol_brt_delta when handling PubNub/HTTP JSON commands. The described access pattern copies a 4-byte buffer into a RAM location (global_s_vol at 0xa0001700) via an unconstrained src fo...

CVE-2017-16346

CVE-2017-16346 affects Insteon Hub firmware 1012. A path through the PubNub/JSON message handler can copy strings with strcpy into a 25-byte buffer for s_mac (buf at 0xa000170c), enabling a global RAM overflow when the input exceeds the limit. The vulnerable flow occurs during processing of the s...

CVE-2017-16340

CVE-2017-16340 affects Insteon Hub firmware 1012. The vulnerability is caused by unsafely copying the s_dport value via strcpy into a 6-byte buffer during PubNub JSON handling (cmd s_sonos), enabling a global RAM overflow. Exploitation requires an authenticated PubNub/HTTP request. Talos notes fi...

CVE-2017-14445

This CVE affects Insteon Hub firmware 1012. The HTTP server mishandles the host parameter during a firmware-update request, performing unsafe copies into a global buffer and enabling a buffer overflow via a crafted GET request. The exploit path requires at least three GET parameters, with the thi...

CVE-2017-16342

CVE-2017-16342 affects Insteon Hub firmware 1012 and is a buffer overflow in the PubNub/JSON command handling path. The vulnerability occurs when processing a s_sonos command with the s_vol_dim_delta field: the code copies the string with strcpy into a 4-byte buffer at 0xa0000514, allowing overfl...

CVE-2017-14446

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this...

CVE-2017-16338

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large, sending anything longer will cause a buffer...

CVE-2017-14444

CVE-2017-14444 describes a buffer overflow in Insteon Hub firmware 1012 triggered by the HTTPUpdate URL parameter during a firmware update request. The vulnerability arises in the HTTP server’s handling of GET parameters in HTTPExecuteGet, with a parameter (update URL) copied via strcpy, potentia...

CVE-2017-16341

CVE-2017-16341 : Insteon Hub firmware 1012 suffers a global buffer overflow in the PubNub message handler. When processing the JSON command "{"cmd":"s_sonos", "sn_sonos_cmd":"volume", "s_vol_play":"..."}", the value for the s_vol_play key is copied with strcpy into an 8-byte buffer at 0xa0001700,...

CVE-2018-3834

Summary of CVE-2018-3834, Insteon Hub : The issue affects Insteon Hub firmware 1013. The PubNub-based firmware upgrade fetches signed binaries over plain HTTP and does not verify the firmware image type, allowing an attacker to supply a mismatched FW/PLM image signed with the same key. If a PLM i...

CVE-2017-16345

CVE-2017-16345 is a buffer overflow in the Insteon Hub 2245-222 with firmware 1012, triggered via PubNub/HTTP requests to the cc channel. In the s_sonos path, the value of the s_port key is copied with strcpy into a 6-byte buffer at 0xa00017f4, and the destination can be shifted by sn_speaker 0–3...

PT-2018-6275 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the s mac key value is copied to a 25-byte buffer using strcpy. Sending a value longer than 2...

PT-2018-6274 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger it. Specifically, it involves copying the value for the s port key to a buffer using strcpy. This buffer has a size of 6 bytes...

PT-2018-5646 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A buffer overflow issue exists due to the incorrect handling of the host parameter by the HTTP server implementation during a firmware update request. This leads to a buffer overflow on a global section. ...