PT-2018-16226 · Insteon · Insteon Hub

Published 2018-08-23 · Updated 2023-02-03 · CVE-2018-3832

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insteon Hub version 1013

Description An exploitable firmware update issue exists in the Insteon Hub. The HTTP server allows uploading arbitrary MPFS binaries, which can be modified to access hidden resources for uploading unsigned firmware images. To exploit this, an attacker can upload an MPFS binary via the "/mpfsupload" HTTP form, then upload firmware via a POST request to "firmware.htm".

Recommendations For Insteon Hub version 1013, as a temporary workaround, consider disabling access to the "/mpfsupload" HTTP form and restricting POST requests to "firmware.htm" until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-3832

Affected Products

Insteon Hub

References · 5

• https://osv.dev/vulnerability/CVE-2018-3832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3832 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0511 · Note
• https://t.me/cvenotify/43566 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144976 · Note