CVE-2017-14455

Affected product: Insteon Hub 2245-222 with firmware 1012. Root cause: unsafe use of strcpy in PubNub control channel handler, overflowing the 16-byte insteon_pubnub.channel_ak buffer and potentially overwriting adjacent data. Impact: remote code execution risk via specially crafted PubNub respon...

CVE-2017-16337

The CVE-2017-16337 entry concerns Insteon Hub 2245-222 devices with firmware 1012, where PubNub message handling can trigger a stack-based buffer overflow via unconstrained strcpy calls when processing JSON fields such as cmd, usr, pwd, etc. The vulnerability arises from copying user-supplied val...

CVE-2017-14455

On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. A...

CVE-2017-14453

CVE-2017-14453 describes multiple PubNub-related buffer-overflow vulnerabilities in Insteon Hub 2245-222 with firmware 1012. The issues stem from unsafe strcpy usage when handling PubNub JSON fields (cc_r, ad_r, al, ak) that overflow 16-byte buffers in insteon_pubnub, enabling potential code exec...

CVE-2017-16337

On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. At 0x9d01ef24 the value f...

Design/Logic Flaw

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

CVE-2017-16348

An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability...

Design/Logic Flaw

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

CVE-2017-16348

An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability...

CVE-2018-3833

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

CVE-2018-3833

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

CVE-2018-3832

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

Denial of service

An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability...

CVE-2018-3832

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

CVE-2017-16348

An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability...

CVE-2018-3832

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

CVE-2018-3833

CVE-2018-3833 affects Insteon Hub (firmware 1013). The firmware upgrade flow fetches signed firmware over plain HTTP and does not verify that the new image is newer than the installed one, enabling an attacker (MITM impersonating cache.insteon.com) to flash older firmware. TALOS research notes mi...

CVE-2017-16348

CVE-2017-16348 is a confirmed Insteon Hub DoS vulnerability affecting firmware 1012. A leftover demo task (RebootTask) reboots the device when it receives a UDP packet, exploitable without authentication. Talos reports attackers can continuously send UDP packets to port 69 to render the device un...

CVE-2018-3833

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

CVE-2018-3832

Summary: Insteon Hub with firmware 1013 is vulnerable to an MPFS upload flaw. The HTTP server accepts uploading arbitrary MPFS binaries via /mpfsupload and can trigger unsigned firmware updates via firmware.htm, allowing full firmware flashing with no signature checks. Credentials are required to...