Read the docs
TI-2018-02804 Aliases CVE-2018-3834GHSA-9hrj-7j37-g424

Origin validation error in Insteon

Priority LOW 33CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-346.

Summary

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs, flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability, an attacker needs to impersonate the remote server "cache.insteon.com" and serve a signed firmware image.

Why it matters now

EPSS 0.00512 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
InsteonInsteonInsteon Hub 2245-222 - Firmware version 1013—No fix listedCNA
  • Insteon VendorInsteon Affected Insteon Hub 2245-222 - Firmware version 1013 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:insteon:hub_firmware:1013:*:*:*:*:*:*:*1013VulnerableInsteon
cpe:2.3:h:insteon:hub:-:*:*:*:*:*:*:*not specified by NVDRunning onInsteon
  • cpe:2.3:o:insteon:hub_firmware:1013:*:*:*:*:*:*:* Versions 1013 Vulnerable ·Insteon
  • cpe:2.3:h:insteon:hub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Insteon

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-3834
  2. 2026-10-03 Alias added: GHSA-9hrj-7j37-g424

References

Exploit 1

  • TI-2017-12035 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
  • TI-2017-12034 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
  • TI-2017-12033 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
  • TI-2017-12032 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
  • TI-2017-12031 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
  • TI-2017-12017 Stack-based buffer overflow in Insteon Hub CVSS 3.1CRITICAL 9.9
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences