The HTTP server implementation unsafely extracts parameters from the query string, leading to a buffer overflow on the stack.

An attacker can send an HTTP GET request to trigger this vulnerability.Īn exploitable stack-based buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the host parameter during a firmware update request, leading to a buffer overflow on a global section. An attacker can send an HTTP GET request to trigger this vulnerability.Īn exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. The HTTP server implementation incorrectly handles the URL parameter during a firmware update request, leading to a buffer overflow on a global section. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.Īn exploitable buffer overflow vulnerability exists in Insteon Hub running firmware version 1012. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6.

IPv6 is enabled for the WAN interface by default on these devices. A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers.

Download lansweeper 10.4 0.2