What is CVE-2018-3895?

CVE-2018-3895 is a high-severity vulnerability in Samsung, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.8/10. Published 2018-08-28.

How severe is CVE-2018-3895?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2018-3895 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Samsung

CVE-2018-3895

An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long 'endTime' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.

Vulnerability class: Buffer Overflow

EPSS: 0.018 (76.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Samsung — versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17
Samsung Sth-eth-250
Samsung Sth-eth-250_firmware — versions 0.20.17

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

References

talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-3895?: CVE-2018-3895 is a high-severity vulnerability in Samsung, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.8/10. Published 2018-08-28.
How severe is CVE-2018-3895?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2018-3895 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.