{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-23T22:58:35.689","vulnerabilities":[{"cve":{"id":"CVE-2018-3833","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T14:29:00.480","lastModified":"2026-06-17T01:57:52.097","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed and thus allows for flashing older firmware images. To trigger this vulnerability, an attacker needs to impersonate the remote server 'cache.insteon.com' and serve any signed firmware image."},{"lang":"es","value":"Existe una vulnerabilidad de degradación de firmware explotable en Insteon Hub con la versión de firmware 1013. La funcionalidad de actualización de firmware, activada mediante PubNub, recuperar binarios de firmware firmados utilizando peticiones HTTP planas. El dispositivo no comprueba la versión de firmware que se va a instalar y por lo tanto permite que se instalen imágenes de firmware más antiguas. Para desencadenar esta vulnerabilidad, un atacante necesita suplantar el servidor remoto \"cache.insteon.com\" y servir cualquier imagen de firmware firmada."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Insteon","product":"Insteon","versions":[{"version":"Insteon Hub 2245-222 - Firmware version 1013","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:insteon:hub_2245-222_firmware:1013:*:*:*:*:*:*:*","matchCriteriaId":"69E53BAA-E75D-4868-8834-09466CA61026"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:insteon:hub_2245-222:-:*:*:*:*:*:*:*","matchCriteriaId":"150E9049-5523-4BC3-A5A5-473B6D320B68"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512","source":"talos-cna@cisco.com","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0512","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"]}]}}]}