Details of VAR-201808-0147

ID

VAR-201808-0147

CVE

CVE-2017-16338

TITLE

Insteon Hub Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-014118 // CNNVD: CNNVD-201808-077

DESCRIPTION

An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01bad0 the value for the host key is copied using strcpy to the buffer at 0xa00016e0. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow. Insteon Hub Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. InsteonHub is an Insteon central controller from Insteon, USA. This product can remotely control light bulbs, wall switches, air conditioners, etc. in the home. A buffer overflow vulnerability exists in InsteonHub using version 1012 firmware. Insteon Hub is an Insteon central controller product of Insteon Company in the United States

Trust: 2.34

sources: NVD: CVE-2017-16338 // JVNDB: JVNDB-2017-014118 // CNVD: CNVD-2018-16255 // VULHUB: VHN-107250 // VULMON: CVE-2017-16338

IOT TAXONOMY

category:	['Network device']	sub_category:	Gateway / Hub: Open Ecosystem	Trust: 0.6
category:	['home & office device']	sub_category:	smart home device	Trust: 0.1
category:	['home & office device']	sub_category:	smart home controller	Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2018-16255

AFFECTED PRODUCTS

vendor:

insteon

model:

hub

scope:

version:

1012

Trust: 3.0

sources: CNVD: CNVD-2018-16255 // JVNDB: JVNDB-2017-014118 // CNNVD: CNNVD-201808-077 // NVD: CVE-2017-16338

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-16338
value:	CRITICAL
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-16338
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-16338
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2018-16255
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201808-077
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-107250
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-16338
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-16338
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2018-16255
severity:	HIGH
baseScore:	7.6
vectorString:	AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-107250
severity:	HIGH
baseScore:	8.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-16338
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.1
impactScore:	6.0
version:	3.1
Trust: 1.0
talos-cna@cisco.com:	CVE-2017-16338
baseSeverity:	HIGH
baseScore:	8.5
vectorString:	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	6.0
version:	3.0
Trust: 1.0
NVD:	CVE-2017-16338
baseSeverity:	CRITICAL
baseScore:	9.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2018-16255 // VULHUB: VHN-107250 // VULMON: CVE-2017-16338 // JVNDB: JVNDB-2017-014118 // CNNVD: CNNVD-201808-077 // NVD: CVE-2017-16338 // NVD: CVE-2017-16338

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.1
problemtype:	CWE-119	Trust: 0.9

sources: VULHUB: VHN-107250 // JVNDB: JVNDB-2017-014118 // NVD: CVE-2017-16338

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201808-077

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201808-077

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014118

PATCH

title:

Top Page

url:

https://www.insteon.com

Trust: 0.8

sources: JVNDB: JVNDB-2017-014118

EXTERNAL IDS

db:	NVD	id:	CVE-2017-16338	Trust: 3.3
db:	TALOS	id:	TALOS-2017-0484	Trust: 3.2
db:	JVNDB	id:	JVNDB-2017-014118	Trust: 0.8
db:	CNNVD	id:	CNNVD-201808-077	Trust: 0.7
db:	CNVD	id:	CNVD-2018-16255	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1
db:	VULHUB	id:	VHN-107250	Trust: 0.1
db:	VULMON	id:	CVE-2017-16338	Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2018-16255 // VULHUB: VHN-107250 // VULMON: CVE-2017-16338 // JVNDB: JVNDB-2017-014118 // CNNVD: CNNVD-201808-077 // NVD: CVE-2017-16338

REFERENCES

url:	https://www.talosintelligence.com/vulnerability_reports/talos-2017-0484	Trust: 2.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16338	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-16338	Trust: 0.8
url:	https://talosintelligence.com/vulnerability_reports/talos-2017-0484	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/120.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2018-16255 // VULHUB: VHN-107250 // VULMON: CVE-2017-16338 // JVNDB: JVNDB-2017-014118 // CNNVD: CNNVD-201808-077 // NVD: CVE-2017-16338

SOURCES

db:	OTHER	id:	-
db:	CNVD	id:	CNVD-2018-16255
db:	VULHUB	id:	VHN-107250
db:	VULMON	id:	CVE-2017-16338
db:	JVNDB	id:	JVNDB-2017-014118
db:	CNNVD	id:	CNNVD-201808-077
db:	NVD	id:	CVE-2017-16338

LAST UPDATE DATE

2025-01-30T22:36:20.538000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-16255	date:	2018-08-27T00:00:00
db:	VULHUB	id:	VHN-107250	date:	2022-12-09T00:00:00
db:	VULMON	id:	CVE-2017-16338	date:	2022-12-09T00:00:00
db:	JVNDB	id:	JVNDB-2017-014118	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201808-077	date:	2022-12-12T00:00:00
db:	NVD	id:	CVE-2017-16338	date:	2024-11-21T03:16:17.273

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-16255	date:	2018-08-27T00:00:00
db:	VULHUB	id:	VHN-107250	date:	2018-08-02T00:00:00
db:	VULMON	id:	CVE-2017-16338	date:	2018-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-014118	date:	2018-10-26T00:00:00
db:	CNNVD	id:	CNNVD-201808-077	date:	2018-08-03T00:00:00
db:	NVD	id:	CVE-2017-16338	date:	2018-08-02T19:29:00.357