CVE-2018-3833 Security feature bypass in Insteon

High 8.6 Published 23 Aug 2018 Updated 17 Sep 2024

Attackers can downgrade Insteon Hub firmware by impersonating the update server, bypassing version checks to install older, potentially vulnerable images.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-3833?

CVE-2018-3833 is a high-severity vulnerability in Insteon, published on 23 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image.

Which versions are affected by CVE-2018-3833?

It affects 1 product.

Products include Insteon Hub 2245-222 Firmware.

How do I fix CVE-2018-3833?

No fix has been published for CVE-2018-3833 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-3833 being exploited?

There is no known exploitation of CVE-2018-3833 in the wild and no public exploit code.

Sources

Also known as GHSA-7hr9-pwpq-qj4c.