VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 23, 2018· Updated Jun 17, 2026

CVE-2018-3833

CVE-2018-3833

Description

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Insteon/Hubllm-fuzzy2 versions
    =1013+ 1 more
    • (no CPE)range: =1013
    • (no CPE)range: Insteon Hub 2245-222 - Firmware version 1013

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.