Buffer overflow in Samsung
CVE-2018-3916
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can send an arbitrarily long 'directory' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (31.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Samsung — versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17
- Samsung Sth-eth-250
- Samsung Sth-eth-250_firmware — versions 0.20.17
Weakness classification (CWE)
References
- talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-3916?
- CVE-2018-3916 is a high-severity vulnerability in Samsung, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2018-08-28.
- How severe is CVE-2018-3916?
- High severity. CVSS v3 base score is 7.8 out of 10.