What is CVE-2017-14454?

CVE-2017-14454 is a high-severity vulnerability in Insteon Hub, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.5/10. Published 2023-01-12.

How severe is CVE-2017-14454?

High severity. CVSS v3 base score is 8.5 out of 10.

Buffer overflow in Insteon Hub

CVE-2017-14454

Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.

Vulnerability class: Buffer Overflow

EPSS: 0.006 (45.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Insteon Hub — versions Not specified
Insteon Hub_firmware — versions 1012

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

talos-cna@cisco.com (Technical Description, Third Party Advisory)

Frequently asked questions

What is CVE-2017-14454?: CVE-2017-14454 is a high-severity vulnerability in Insteon Hub, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.5/10. Published 2023-01-12.
How severe is CVE-2017-14454?: High severity. CVSS v3 base score is 8.5 out of 10.