CRITICAL🇵🇱 Wersja polska

CVE-2017-16260

CVSS 9.9v3.1pub. 2023-01-11upd. 2024-11-21

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_auth, at 0x9d015478, the value for the `pwd` key is copied using `strcpy` to the buffer at `$sp+0x2b0`.This buffer is 32 bytes large, sending anything longer will cause a buffer overflow.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Insteon Hub

    HW
    Insteon
    all versions

  • Insteon Hub Firmware

    OS
    Insteon
    1012
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2017-16258CRITICAL9.9PL ✓same product

Stack-based buffer overflow w Insteon Hub — obsługa wiadomości PubNub

CVE-2017-16259CRITICAL9.9PL ✓same product

Stack-based buffer overflow w Insteon Hub Firmware — kanał PubNub

CVE-2017-16256CRITICAL9.9PL ✓same product

Stack-based buffer overflow w Insteon Hub via PubNub — kanał 'cc'

CVE-2017-16257CRITICAL9.9PL ✓same product

Stack-based buffer overflow w Insteon Hub Firmware via PubNub

CVE-2017-16262CRITICAL9.9PL ✓same product

Stack-based buffer overflow w obsłudze wiadomości PubNub w Insteon Hub