Login Request a demo
Critical severity · published Aug 2, 2018
CVE-2017-16339
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012
9.9
CVSS
1.4%
EPSS
No
On KEV
Description
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bb1c the value for the uri key is copied using strcpy to the buffer at 0xa00016a0. This buffer is 64 bytes large, sending anything longer will cause a buffer overflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Insteon · Insteon
Insteon Hub 2245-222 - Firmware version 1012 · source: vendor
HF
Hub Firmware · Insteon
1012 · source: NVD
Affected product
IN
Insteon
Insteon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-16339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-16339
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0484
More from Insteon
9.9
CVE-2017-14444
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-14445
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-14446
An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-16338
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012
9.9
CVE-2017-16340
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012