CVE-2018-3834 - CVE House
Back to Database
Status published High CVE-2018-3834

An exploitable permanent denial of service vulnerability exists in Insteon...

Vulnerability Description

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server "cache.insteon.com" and serve a signed firmware image.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-3834

Credits & Attribution

No credits recorded in the NVD database.

References

More from Insteon

View All →
CVE-2018-3833
An exploitable firmware downgrade vulnerability exists in Insteon Hub running...
High 8.6
CVE-2018-3832
An exploitable firmware update vulnerability exists in Insteon Hub running...
Critical 9.9
CVE-2017-5251
In version 1012 and prior of Insteon's Insteon Hub, the...
High 8.1
CVE-2017-5250
In version 1.9.7 and prior of Insteon's Insteon for Hub...
Critical 9.8
CVE-2017-16349
An exploitable XML external entity vulnerability exists in the reporting...
Medium 6.4

Affected Vendor

Affected Software

Insteon
Vulnerable Versions:
Insteon Hub 2245-222 - Firmware version 1013

Timeline

Official Publish: August 2nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.