High severity · published Aug 2, 2018
CVE-2018-3834
An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server "cache.insteon.com" and serve a signed firmware image.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Insteon · Insteon
Insteon Hub 2245-222 - Firmware version 1013 · source: vendor
HF
Hub Firmware · Insteon
1013 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3834
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3834
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0513
More from Insteon
9.9
CVE-2017-14444
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-14445
An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-14446
An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012
9.9
CVE-2017-16338
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012
9.9
CVE-2017-16339
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012