PT-2018-16226 · Insteon · Insteon Hub

CVE-2018-3832 · Publicado 2018-08-23 · Atualizado 2023-02-03

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insteon Hub version 1013

Description An exploitable firmware update issue exists in the Insteon Hub. The HTTP server allows uploading arbitrary MPFS binaries, which can be modified to access hidden resources for uploading unsigned firmware images. To exploit this, an attacker can upload an MPFS binary via the "/mpfsupload" HTTP form, then upload firmware via a POST request to "firmware.htm".

Recommendations For Insteon Hub version 1013, as a temporary workaround, consider disabling access to the "/mpfsupload" HTTP form and restricting POST requests to "firmware.htm" until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-3832

Produtos afetados

Insteon Hub

Referências · 5

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0511 · Nota
• https://osv.dev/vulnerability/CVE-2018-3832 · Aviso do Fabricante
• https://t.me/cvenotify/43566 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144976 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3832 · Nota de Segurança