CVE-2017-14452 - CVE House
Back to Database
Status published High CVE-2017-14452

An exploitable buffer overflow vulnerability exists in the PubNub message...

Vulnerability Description

An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. A strcpy overflows the buffer insteon_pubnub.channel_cc_r, which has a size of 16 bytes. An attacker can send an arbitrarily long "c_r" parameter in order to exploit this vulnerability. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14452

Credits & Attribution

No credits recorded in the NVD database.

References

More from Insteon

View All →
CVE-2018-3834
An exploitable permanent denial of service vulnerability exists in Insteon...
High 8.7
CVE-2018-3833
An exploitable firmware downgrade vulnerability exists in Insteon Hub running...
High 8.6
CVE-2018-3832
An exploitable firmware update vulnerability exists in Insteon Hub running...
Critical 9.9
CVE-2017-5251
In version 1012 and prior of Insteon's Insteon Hub, the...
High 8.1
CVE-2017-5250
In version 1.9.7 and prior of Insteon's Insteon for Hub...
Critical 9.8

Affected Vendor

Affected Software

Insteon Hub 2245-222
Vulnerable Versions:
Firmware version 1012

Timeline

Official Publish: August 23rd, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.