CVE-2018-3834

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going t...

CVE-2017-16339

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer...

CVE-2017-16340

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c0e8 the value for the sdport key is copied using strcpy to the buffer at 0xa000180c. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-14445

This CVE affects Insteon Hub firmware 1012. The HTTP server mishandles the host parameter during a firmware-update request, performing unsafe copies into a global buffer and enabling a buffer overflow via a crafted GET request. The exploit path requires at least three GET parameters, with the thi...

CVE-2017-16347

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the svol key is copied using strcpy to the buffer at 0xa0001700. This buffer is maximum 12 bytes large this is the maximum size it could be,...

CVE-2017-16345

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c318 the value for the sport key is copied using strcpy to the buffer at 0xa00017f4. This buffer is 6 bytes large, sending anything longer will cause a buffer...

CVE-2017-14444

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to...

CVE-2017-16340

CVE-2017-16340 affects Insteon Hub firmware 1012. The vulnerability is caused by unsafely copying the s_dport value via strcpy into a 6-byte buffer during PubNub JSON handling (cmd s_sonos), enabling a global RAM overflow. Exploitation requires an authenticated PubNub/HTTP request. Talos notes fi...

CVE-2017-16346

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the smac key is copied using strcpy to the buffer at 0xa000170c. This buffer is 25 bytes large, sending anything longer will cause a buffer...

CVE-2017-16346

CVE-2017-16346 affects Insteon Hub firmware 1012. A path through the PubNub/JSON message handler can copy strings with strcpy into a 25-byte buffer for s_mac (buf at 0xa000170c), enabling a global RAM overflow when the input exceeds the limit. The vulnerable flow occurs during processing of the s...

CVE-2017-14446

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this...

CVE-2017-16338

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large, sending anything longer will cause a buffer...

CVE-2017-16341

CVE-2017-16341 : Insteon Hub firmware 1012 suffers a global buffer overflow in the PubNub message handler. When processing the JSON command "{"cmd":"s_sonos", "sn_sonos_cmd":"volume", "s_vol_play":"..."}", the value for the s_vol_play key is copied with strcpy into an 8-byte buffer at 0xa0001700,...

CVE-2017-16345

CVE-2017-16345 is a buffer overflow in the Insteon Hub 2245-222 with firmware 1012, triggered via PubNub/HTTP requests to the cc channel. In the s_sonos path, the value of the s_port key is copied with strcpy into a 6-byte buffer at 0xa00017f4, and the destination can be shifted by sn_speaker 0–3...

CVE-2017-14444

CVE-2017-14444 describes a buffer overflow in Insteon Hub firmware 1012 triggered by the HTTPUpdate URL parameter during a firmware update request. The vulnerability arises in the HTTP server’s handling of GET parameters in HTTPExecuteGet, with a parameter (update URL) copied via strcpy, potentia...

CVE-2018-3834

Summary of CVE-2018-3834, Insteon Hub : The issue affects Insteon Hub firmware 1013. The PubNub-based firmware upgrade fetches signed binaries over plain HTTP and does not verify the firmware image type, allowing an attacker to supply a mismatched FW/PLM image signed with the same key. If a PLM i...

PT-2018-5646 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A buffer overflow issue exists due to the incorrect handling of the host parameter by the HTTP server implementation during a firmware update request. This leads to a buffer overflow on a global section. ...

PT-2018-6275 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, the s mac key value is copied to a 25-byte buffer using strcpy. Sending a value longer than 2...

PT-2018-6274 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger it. Specifically, it involves copying the value for the s port key to a buffer using strcpy. This buffer has a size of 6 bytes...

PT-2018-6268 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue allows an attacker to send an authenticated HTTP request to trigger a buffer overflow. Specifically, at memory address 0x9d01bb1c, the value for the uri key is copied using strcpy to a buffer at...