PT-2018-8243 · Insteon · Insteon For Hub

Deral Heiland · Published 2018-02-22 · Updated 2019-10-09 · CVE-2017-5250

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Insteon for Hub Android app versions 1.9.7 and prior

Description: The issue concerns the insecure storage of the OAuth token used for authorizing user access. This token is not stored in an encrypted and secure manner, potentially exposing user data.

Recommendations: For versions 1.9.7 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-922

CWE-312

Related Identifiers

CVE-2017-5250

Affected Products

Insteon For Hub

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5250 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5250 · Vendor Advisory
• https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems · Note