CVE-2018-3833

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512	Exploit Technical Description Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:insteon:hub_2245-222_firmware:1013:*:*:*:*:*:*:*

cpe:2.3:h:insteon:hub_2245-222:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:06

Type	Values Removed	Values Added
References	~~() https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512 - Exploit, Technical Description, Third Party Advisory~~	() https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512 - Exploit, Technical Description, Third Party Advisory

Information

Published : 2018-08-23 14:29

Updated : 2024-11-21 04:06

NVD link : CVE-2018-3833

Mitre link : CVE-2018-3833

CVE.ORG link : CVE-2018-3833

JSON object : View

Products Affected

insteon

hub_2245-222_firmware
hub_2245-222

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-3833", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-08-23T14:29:00.480", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image."}, {"lang": "es", "value": "Existe una vulnerabilidad de degradaci\u00f3n de firmware explotable en Insteon Hub con la versi\u00f3n de firmware 1013. La funcionalidad de actualizaci\u00f3n de firmware, activada mediante PubNub, recuperar binarios de firmware firmados utilizando peticiones HTTP planas. El dispositivo no comprueba la versi\u00f3n de firmware que se va a instalar y por lo tanto permite que se instalen im\u00e1genes de firmware m\u00e1s antiguas. Para desencadenar esta vulnerabilidad, un atacante necesita suplantar el servidor remoto \"cache.insteon.com\" y servir cualquier imagen de firmware firmada."}], "lastModified": "2024-11-21T04:06:07.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insteon:hub_2245-222_firmware:1013:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69E53BAA-E75D-4868-8834-09466CA61026"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:insteon:hub_2245-222:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "150E9049-5523-4BC3-A5A5-473B6D320B68"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}