TI-2017-03360 Aliases CVE-2017-5251 GHSA-w7p3-wrmf-pg65

Authentication bypass by capture-replay in Insteon Hub Firmware

LOW 36CWE-294Published 2018-02-22 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-294 and CWE-311.

Summary

In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted.

Why it matters now

EPSS 0.00522 44th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Insteon	Insteon Hub Firmware	1012	—	No fix listed	CNA

Insteon Hub Firmware VendorInsteon Affected 1012 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:insteon:insteon_hub_firmware::::::::	up to 1012	Vulnerable	Insteon
cpe:2.3:h:insteon:insteon_hub:-:::::::*	not specified by NVD	Running on	Insteon

cpe:2.3:o:insteon:insteon_hub_firmware:*:*:*:*:*:*:*:* Versions up to 1012 Vulnerable ·Insteon
cpe:2.3:h:insteon:insteon_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Insteon

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-5251
2026-10-03 Alias added: GHSA-w7p3-wrmf-pg65

References

Advisory 1

https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/

TI-2017-12009 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
TI-2017-12008 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
TI-2017-12007 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
TI-2017-12006 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
TI-2017-12005 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
TI-2017-12004 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences