PT-2018-6266 · Pubnub+1 · Pubnub+1

Published 2018-08-23 · Updated 2022-12-09 · CVE-2017-16337

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Insteon Hub 2245-222 version 1012

Description: The issue is caused by a stack-based buffer overflow that can be triggered by sending specially crafted commands through the PubNub service. This can overwrite arbitrary data. An attacker needs to send an authenticated HTTP request to exploit this issue. The vulnerability occurs when the value for the s offset key is copied using strcpy to a buffer at $sp+0x2b0, which is 32 bytes large. Sending data longer than 32 bytes will cause a buffer overflow.

Recommendations: For Insteon Hub 2245-222 version 1012, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2017-16337

Affected Products

Insteon Hub 2245-222

Pubnub

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483 · Exploit
• https://osv.dev/vulnerability/CVE-2017-16337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16337 · Security Note
• https://t.me/cvenotify/39522 · Telegram Post