Login Request a demo
Medium severity · published Sep 17, 2018
CVE-2017-14443
An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012
6.5
CVSS
1.8%
EPSS
No
On KEV
Description
An exploitable information leak vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly checks the number of GET parameters supplied, leading to an arbitrarily controlled information leak on the whole device memory. An attacker can send an authenticated HTTP request to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
Hub 2245-222 Firmware · Insteon
1012 · source: NVD
Affected product
H2
Hub 2245-222 Firmware
Insteon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14443
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14443
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0492
More from Hub 2245-222 Firmware
9.0
CVE-2018-3832
An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013
8.8
CVE-2017-16337
On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting…
8.8
CVE-2017-14455
On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting…
8.8
CVE-2017-14453
On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting…
7.5
CVE-2018-3833
An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013