CVE-2017-14454

Multiple exploitable buffer overflow vulnerabilities exists in the PubNub message handler for the "control" channel of Insteon Hub running firmware version 1012. Specially crafted replies received from the PubNub service can cause buffer overflows on a global section overwriting arbitrary data. An attacker should impersonate PubNub and answer an HTTPS GET request to trigger this vulnerability. The `strcpy` at [18] overflows the buffer `insteon_pubnub.channel_al`, which has a size of 16 bytes.

• CWE-120
• CWE-120

• https://talosintelligence.com/vulnerability_reports/TALOS-2017-0502Technical Description, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2017-0502Technical Description, Third Party Advisory

Published

Jan 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14449A double-Free vulnerability exists in the XCF image renderin…7.5
• CVE-2017-1445IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulner…
• CVE-2017-14450A buffer overflow vulnerability exists in the GIF image pars…7.1
• CVE-2017-14451An exploitable out-of-bounds read vulnerability exists in li…10
• CVE-2017-14452An exploitable buffer overflow vulnerability exists in the P…8.5
• CVE-2017-14453On Insteon Hub 2245-222 devices with firmware version 1012, …8.5
• CVE-2017-14455On Insteon Hub 2245-222 devices with firmware version 1012, …8.5
• CVE-2017-14456Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-14457An exploitable information leak/denial of service vulnerabil…8.2
• CVE-2017-14458An exploitable use-after-free vulnerability exists in the Ja…8.8
• CVE-2017-14459An exploitable OS Command Injection vulnerability exists in …10
• CVE-2017-1446IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulner…5.4