CVE-2017-16298
CVSS V2 None
CVSS V3 None
Description
Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_schd, at 0x9d01a264, the value for the `offcmd` key is copied using `strcpy` to the buffer at `$sp+0x334`.This buffer is 100 bytes large, sending anything longer will cause a buffer overflow.
Overview
- CVE ID
- CVE-2017-16298
- Assigner
- talos-cna@cisco.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-01-11T22:15:12
- Last Modified Date
- 2023-01-23T16:52:15
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:insteon:insteon_hub_firmware:1012:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:insteon:insteon_hub:-:*:*:*:*:*:*:* | 0 | OR |
References
| Reference URL | Reference Tags |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2017-0483 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2017-16298 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16298 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-01-12 05:18:40 | Added to TrackCVE | |||
| 2023-01-12 05:18:41 | Weakness Enumeration | new | ||
| 2023-01-12 14:15:28 | 2023-01-12T13:56:10 | CVE Modified Date | updated | |
| 2023-01-12 14:15:28 | Received | Awaiting Analysis | Vulnerability Status | updated |
| 2023-01-12 14:15:31 | CVSS V3 information | new | ||
| 2023-01-17 14:14:39 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |
| 2023-01-17 14:14:43 | CVSS V3 information | new | ||
| 2023-01-23 17:13:48 | 2023-01-23T16:52:15 | CVE Modified Date | updated | |
| 2023-01-23 17:13:48 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
| 2023-01-23 17:13:52 | CPE Information | updated | ||
| 2023-01-23 17:13:52 | CVSS V3 information | new |