CVE-2017-14454: insteon hub_firmware Classic Buffer Overflow

Vulnerability summary

CVE-2017-14454 is a high (CVSS 8.5) Classic Buffer Overflow vulnerability in insteon hub_firmware. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.

Timeline

1. 11-01-2023
   PublishedVulnerability first disclosed.
2. 09-04-2025
   Last modifiedVulnerability information updated.

Description

Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.