Details of VAR-201808-0080

ID

VAR-201808-0080

CVE

CVE-2017-14445

TITLE

Insteon Hub Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-014116 // CNNVD: CNNVD-201709-623

DESCRIPTION

An exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability. Insteon Hub Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Insteon Hub is an Insteon central controller product of Insteon Company in the United States. This product can remotely control light bulbs, wall switches, air conditioners, etc. in your home

Trust: 1.8

sources: NVD: CVE-2017-14445 // JVNDB: JVNDB-2017-014116 // VULHUB: VHN-105168 // VULMON: CVE-2017-14445

IOT TAXONOMY

category:	['home & office device']	sub_category:	smart home device	Trust: 0.1
category:	['home & office device']	sub_category:	smart home controller	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:

insteon

model:

hub

scope:

version:

1012

Trust: 2.4

sources: JVNDB: JVNDB-2017-014116 // CNNVD: CNNVD-201709-623 // NVD: CVE-2017-14445

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-14445
value:	CRITICAL
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-14445
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-14445
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201709-623
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-105168
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-14445
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-14445
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-105168
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-14445
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-14445
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	2.5
version:	3.0
Trust: 1.0
NVD:	CVE-2017-14445
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-105168 // VULMON: CVE-2017-14445 // JVNDB: JVNDB-2017-014116 // CNNVD: CNNVD-201709-623 // NVD: CVE-2017-14445 // NVD: CVE-2017-14445

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.1
problemtype:	CWE-119	Trust: 0.9

sources: VULHUB: VHN-105168 // JVNDB: JVNDB-2017-014116 // NVD: CVE-2017-14445

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-623

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201709-623

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014116

PATCH

title:

Top Page

url:

https://www.insteon.com/

Trust: 0.8

sources: JVNDB: JVNDB-2017-014116

EXTERNAL IDS

db:	NVD	id:	CVE-2017-14445	Trust: 2.7
db:	TALOS	id:	TALOS-2017-0494	Trust: 2.6
db:	JVNDB	id:	JVNDB-2017-014116	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-623	Trust: 0.7
db:	OTHER	id:	NONE	Trust: 0.1
db:	SEEBUG	id:	SSVID-97367	Trust: 0.1
db:	VULHUB	id:	VHN-105168	Trust: 0.1
db:	VULMON	id:	CVE-2017-14445	Trust: 0.1

sources: OTHER: None // VULHUB: VHN-105168 // VULMON: CVE-2017-14445 // JVNDB: JVNDB-2017-014116 // CNNVD: CNNVD-201709-623 // NVD: CVE-2017-14445

REFERENCES

url:	https://www.talosintelligence.com/vulnerability_reports/talos-2017-0494	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14445	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-14445	Trust: 0.8
url:	https://talosintelligence.com/vulnerability_reports/talos-2017-0494	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/120.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: OTHER: None // VULHUB: VHN-105168 // VULMON: CVE-2017-14445 // JVNDB: JVNDB-2017-014116 // CNNVD: CNNVD-201709-623 // NVD: CVE-2017-14445

SOURCES

db:	OTHER	id:	-
db:	VULHUB	id:	VHN-105168
db:	VULMON	id:	CVE-2017-14445
db:	JVNDB	id:	JVNDB-2017-014116
db:	CNNVD	id:	CNNVD-201709-623
db:	NVD	id:	CVE-2017-14445

LAST UPDATE DATE

2025-01-30T22:08:35.526000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-105168	date:	2022-12-14T00:00:00
db:	VULMON	id:	CVE-2017-14445	date:	2022-12-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-014116	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201709-623	date:	2022-12-16T00:00:00
db:	NVD	id:	CVE-2017-14445	date:	2024-11-21T03:12:48.593

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-105168	date:	2018-08-02T00:00:00
db:	VULMON	id:	CVE-2017-14445	date:	2018-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-014116	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201709-623	date:	2017-09-15T00:00:00
db:	NVD	id:	CVE-2017-14445	date:	2018-08-02T19:29:00.280