CVE-2017-14452

An exploitable buffer overflow vulnerability exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. A strcpy overflows the buffer insteon_pubnub.channel_cc_r, which has a size of 16 bytes. An attacker can send an arbitrarily long "c_r" parameter in order to exploit this vulnerability. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability.

• CWE-119

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0502Exploit, Third Party Advisory

Published

Aug 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14447An exploitable buffer overflow vulnerability exists in the P…8.5
• CVE-2017-14448An exploitable code execution vulnerability exists in the XC…8.8
• CVE-2017-14449A double-Free vulnerability exists in the XCF image renderin…7.5
• CVE-2017-1445IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulner…
• CVE-2017-14450A buffer overflow vulnerability exists in the GIF image pars…7.1
• CVE-2017-14451An exploitable out-of-bounds read vulnerability exists in li…10
• CVE-2017-14453On Insteon Hub 2245-222 devices with firmware version 1012, …8.5
• CVE-2017-14454Multiple exploitable buffer overflow vulnerabilities exists …8.5
• CVE-2017-14455On Insteon Hub 2245-222 devices with firmware version 1012, …8.5
• CVE-2017-14456Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-14457An exploitable information leak/denial of service vulnerabil…8.2
• CVE-2017-14458An exploitable use-after-free vulnerability exists in the Ja…8.8