CVE-2017-16255

HIGH

Insteon Hub 2245-222 - Firmware 1012 - Buffer Overflow

Title source: llm
STIX 2.1

Description

An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at At 0x9d014e84 the value for the cmd1 key is copied using strcpy to the buffer at $sp+0x280. This buffer is 16 bytes large.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483

Scores

CVSS v3 8.1
EPSS 0.0076
EPSS Percentile 73.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-120
Status published
Products (1)
insteon/hub_firmware 1012
Published Mar 21, 2019
Tracked Since Feb 18, 2026