CVE-2017-16341 - CVE House
Back to Database
Status published High CVE-2017-16341

An attacker could send an authenticated HTTP request to trigger...

Vulnerability Description

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c224 the value for the s_vol_play key is copied using strcpy to the buffer at 0xa0000418. This buffer is maximum 8 bytes large (this is the maximum size it could be, it is possible other global variables are stored between this variable and the next one that we could identify), sending anything longer will cause a buffer overflow.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16341

Credits & Attribution

No credits recorded in the NVD database.

References

More from Insteon

View All →
CVE-2018-3834
An exploitable permanent denial of service vulnerability exists in Insteon...
High 8.7
CVE-2018-3833
An exploitable firmware downgrade vulnerability exists in Insteon Hub running...
High 8.6
CVE-2018-3832
An exploitable firmware update vulnerability exists in Insteon Hub running...
Critical 9.9
CVE-2017-5251
In version 1012 and prior of Insteon's Insteon Hub, the...
High 8.1
CVE-2017-5250
In version 1.9.7 and prior of Insteon's Insteon for Hub...
Critical 9.8

Affected Vendor

Affected Software

Insteon
Vulnerable Versions:
Insteon Hub 2245-222 - Firmware version 1012

Timeline

Official Publish: August 2nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.