CVE-2017-14454

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Jan 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-144558.8On Insteon Hub 2245-222 devices with firmware version 1012, specially crafted replies received from the PubNub service can cause buffer overCVE-2017-144578.2An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of CVE-2017-144588.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013. A specCVE-2017-144599.8An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IECVE-2017-14465.4IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitraryCVE-2017-144607.5An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An CVE-2017-144617.1A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensiCVE-2017-144629.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144639.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144649.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144659.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley MicrolCVE-2017-144669.8An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Microl
CVE-2017-14454: High severity, CVSS 8.5 | Vulnix