CVE-2017-16254

Vulnerability

The vulnerability resides in the PubNub message handler of the Insteon Hub 2245-222 running firmware version 1012. When processing a specially crafted command on the flg key, the value is copied using strcpy to a 16-byte stack buffer at $sp+0x270 without bounds checking. Sending a value longer than 16 bytes causes a stack-based buffer overflow, overwriting arbitrary data on the stack [1].

Exploitation

An attacker must be authenticated to the hub and able to send HTTP requests to the PubNub service endpoint. By crafting a PubNub message with an overly long flg key value, the attacker triggers the overflow at address 0x9d014e4c. No user interaction is required beyond the initial authentication; the overflow occurs during message processing.

Impact

Successful exploitation overwrites adjacent stack memory, potentially allowing the attacker to corrupt critical data or control flow. Given the CVSSv3 score of 8.5 and the nature of stack-based overflows, this can lead to arbitrary code execution with the privileges of the PubNub handler process, effectively compromising the hub's confidentiality, integrity, and availability.

Mitigation

No official fix or updated firmware has been published for this vulnerability as of the advisory date [1]. Users should consider isolating the hub from untrusted networks, restricting authenticated access, or replacing the device if it is no longer supported by the vendor.