What is CVE-2017-14454?

CVE-2017-14454 is a high-severity vulnerability in Insteon Hub, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.5/10. Published 2023-01-12.

How severe is CVE-2017-14454?

High severity. CVSS v3 base score is 8.5 out of 10.

Buffer overflow in Insteon Hub

CVE-2017-14454

Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.

Vulnerability class: Buffer Overflow

Published 2023-01-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (46.7th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Insteon Hub — versions Not specified
Insteon Hub Firmware — versions 1012

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

talosintelligence.com/vulnerability_reports/TALOS-2017-0502 (Technical Description, Third Party Advisory)

Frequently asked questions

What is CVE-2017-14454?: CVE-2017-14454 is a high-severity vulnerability in Insteon Hub, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.5/10. Published 2023-01-12.
How severe is CVE-2017-14454?: High severity. CVSS v3 base score is 8.5 out of 10.