CVE-2017-16253

Vulnerability

A stack-based buffer overflow vulnerability exists in the PubNub message handler of the Insteon Hub 2245-222 running firmware version 1012 [1]. Specifically, the handler for the cc channel at address 0x9d014dd8 copies the value of the id key using strcpy into a stack buffer at $sp+0x290 that is 32 bytes large [1]. Sending a command with an id value longer than 32 bytes overwrites adjacent stack memory [1].

Exploitation

An authenticated attacker can trigger this vulnerability by sending a specially crafted HTTP request through the PubNub service [1]. The attacker must first obtain valid credentials for the Insteon Hub's PubNub interface. The command is crafted to include an overly long id value that overwrites the stack buffer, potentially allowing control of the program's execution flow [1].

Impact

Successful exploitation allows an attacker to cause a stack-based buffer overflow, which can lead to arbitrary code execution on the device [1]. The CVSSv3 score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates high impact on confidentiality, integrity, and availability, with a change in scope meaning the attacker can compromise resources beyond the vulnerable component [1].

Mitigation

Not yet disclosed in the available references. Insteon Hub firmware version 1012 is the affected version. No fixed version or workaround has been published as of the report date [1]. The device may be end-of-life or no longer supported; users should consider upgrading to a supported hub if available.