CVE-2018-3834

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server "cache.insteon.com" and serve a signed firmware image.

• CWE-346

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0513Exploit, Technical Description, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0513Exploit, Technical Description, Third Party Advisory

Published

Aug 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3828Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 conta…
• CVE-2018-3829In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it…5.3
• CVE-2018-3830Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (X…6.1
• CVE-2018-3831Elasticsearch Alerting and Monitoring in versions before 6.4…8.8
• CVE-2018-3832An exploitable firmware update vulnerability exists in Inste…9
• CVE-2018-3833An exploitable firmware downgrade vulnerability exists in In…7.5
• CVE-2018-3835An exploitable out of bounds write vulnerability exists in v…8.8
• CVE-2018-3836An exploitable command injection vulnerability exists in the…7.8
• CVE-2018-3837An exploitable information disclosure vulnerability exists i…5.5
• CVE-2018-3838An exploitable information vulnerability exists in the XCF i…6.5
• CVE-2018-3839An exploitable code execution vulnerability exists in the XC…8.8
• CVE-2018-3840A denial-of-service vulnerability exists in the Pixar Render…7.5