Details of VAR-201808-0081

ID

VAR-201808-0081

CVE

CVE-2017-14446

TITLE

Insteon Hub Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-014117 // CNNVD: CNNVD-201709-622

DESCRIPTION

An exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HTTP GET request to trigger this vulnerability. Insteon Hub Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Insteon Hub is an Insteon central controller product of Insteon Company in the United States. This product can remotely control light bulbs, wall switches, air conditioners, etc. in your home

Trust: 1.8

sources: NVD: CVE-2017-14446 // JVNDB: JVNDB-2017-014117 // VULHUB: VHN-105169 // VULMON: CVE-2017-14446

IOT TAXONOMY

category:	['home & office device']	sub_category:	smart home device	Trust: 0.1
category:	['home & office device']	sub_category:	smart home controller	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:

insteon

model:

hub

scope:

version:

1012

Trust: 2.4

sources: JVNDB: JVNDB-2017-014117 // CNNVD: CNNVD-201709-622 // NVD: CVE-2017-14446

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-14446
value:	CRITICAL
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-14446
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-14446
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201709-622
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-105169
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-14446
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-14446
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-105169
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-14446
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-14446
baseSeverity:	HIGH
baseScore:	8.5
vectorString:	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	6.0
version:	3.0
Trust: 1.0
NVD:	CVE-2017-14446
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-105169 // VULMON: CVE-2017-14446 // JVNDB: JVNDB-2017-014117 // CNNVD: CNNVD-201709-622 // NVD: CVE-2017-14446 // NVD: CVE-2017-14446

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.1
problemtype:	CWE-119	Trust: 0.9

sources: VULHUB: VHN-105169 // JVNDB: JVNDB-2017-014117 // NVD: CVE-2017-14446

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-622

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201709-622

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014117

PATCH

title:

Top Page

url:

https://www.insteon.com

Trust: 0.8

sources: JVNDB: JVNDB-2017-014117

EXTERNAL IDS

db:	NVD	id:	CVE-2017-14446	Trust: 2.7
db:	TALOS	id:	TALOS-2017-0495	Trust: 2.6
db:	JVNDB	id:	JVNDB-2017-014117	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-622	Trust: 0.7
db:	OTHER	id:	NONE	Trust: 0.1
db:	SEEBUG	id:	SSVID-97362	Trust: 0.1
db:	VULHUB	id:	VHN-105169	Trust: 0.1
db:	VULMON	id:	CVE-2017-14446	Trust: 0.1

sources: OTHER: None // VULHUB: VHN-105169 // VULMON: CVE-2017-14446 // JVNDB: JVNDB-2017-014117 // CNNVD: CNNVD-201709-622 // NVD: CVE-2017-14446

REFERENCES

url:	https://www.talosintelligence.com/vulnerability_reports/talos-2017-0495	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14446	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-14446	Trust: 0.8
url:	https://talosintelligence.com/vulnerability_reports/talos-2017-0495	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: OTHER: None // VULHUB: VHN-105169 // VULMON: CVE-2017-14446 // JVNDB: JVNDB-2017-014117 // CNNVD: CNNVD-201709-622 // NVD: CVE-2017-14446

SOURCES

db:	OTHER	id:	-
db:	VULHUB	id:	VHN-105169
db:	VULMON	id:	CVE-2017-14446
db:	JVNDB	id:	JVNDB-2017-014117
db:	CNNVD	id:	CNNVD-201709-622
db:	NVD	id:	CVE-2017-14446

LAST UPDATE DATE

2025-01-30T20:20:15.116000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-105169	date:	2022-12-14T00:00:00
db:	VULMON	id:	CVE-2017-14446	date:	2022-12-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-014117	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201709-622	date:	2022-12-16T00:00:00
db:	NVD	id:	CVE-2017-14446	date:	2024-11-21T03:12:48.710

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-105169	date:	2018-08-02T00:00:00
db:	VULMON	id:	CVE-2017-14446	date:	2018-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-014117	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201709-622	date:	2017-09-15T00:00:00
db:	NVD	id:	CVE-2017-14446	date:	2018-08-02T19:29:00.327