Vulnerability Spotlight: Multiple Remote Vulnerabilities In Insteon Hub Pub Nub

Summary: Cisco Talos disclosed twelve vulnerabilities in the Insteon Hub 2245-222 home controller, ranging from remote code execution to denial of service, most rooted in unsafe use of the strcpy() function causing stack or global overflows. The flaws are fixed in firmware version 1016, with earlier versions potentially vulnerable, and several require authentication to the PubNub service or a man-in-the-middle position to exploit.
What's compelling: An unauthenticated attacker can reboot the device with a single UDP packet, and an attacker who impersonates cache.insteon.com can flash a signed firmware image to the wrong MCU and render the hub permanently unusable.

Read the original at Cisco Talos ↗

Topics: Endpoint & Network Security
Mentions: CVE-2017-14443 CVE-2017-14444 CVE-2017-14445 CVE-2017-16252 CVE-2017-16337 CVE-2017-16338 CVE-2017-16339 CVE-2017-16340 CVE-2017-16341 CVE-2017-16342 CVE-2017-16343 CVE-2017-16344 CVE-2017-16345 CVE-2017-16346 CVE-2017-16347 CVE-2017-16348
Related: Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026
Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026
Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026