CVE-2017-16344 - An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012 · CoreCVE

Back Back to CVE browser

CRITICAL

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012

Published Aug 2, 2018

9.9

CRITICAL

CVSS 3.1

EPSS 1.38%

Description

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c2c8 the value for the s_url key is copied using strcpy to the buffer at 0xa0001a0c. This buffer is 16 bytes large, sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between "0" and "3".

Affected products

Vendor Insteon Product Insteon Default
n/a
- Version
  Insteon Hub 2245-222 - Firmware version 1012
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
Insteon Hub 2245-222 - Firmware version 1012	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (1)

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Aug 2, 2018

Updated Aug 5, 2024

Reserved Oct 31, 2017

Link CVE-2017-16344

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2017-16344

Severity n/a

Public date n/a

Links CVE-2017-16344