CVE-2017-16346 An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the s_mac key is copied using strcpy to the...
CriticalCVSS 9.9
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the s_mac key is copied using strcpy to the buffer at 0xa000170c. This buffer is 25 bytes large, sending anything longer will cause a buffer overflow. The destination can also be shifted by using an sn_speaker parameter between "0" and "3".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| insteon hub firmware | = 1012 | No fix listed |
| Insteon | = Insteon Hub 2245-222 - Firmware version 1012 | No fix listed |
References
- www.talosintelligence.com exploit third-party-advisory