PT-2018-5653 · Insteon+1 · Insteon Hub+1

Published 2018-08-23 · Updated 2022-04-19 · CVE-2017-14455

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012

Description: The issue arises from specially crafted replies received from the PubNub service, which can cause buffer overflows on a global section, overwriting arbitrary data. An attacker must impersonate PubNub and answer an HTTPS GET request to trigger this issue. Specifically, a strcpy overflows the buffer insteon pubnub.channel ak, which has a size of 16 bytes. This can be exploited by sending an arbitrarily long ak parameter.

Recommendations: For Insteon Hub 2245-222 version 1012, as a temporary workaround, consider restricting access to the insteon pubnub.channel ak buffer to minimize the risk of exploitation. Avoid using the ak parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-14455

Affected Products

Insteon Hub

Pubnub

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-14455 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14455 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2017-0502 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144975 · Note