What is CVE-2018-3918?

CVE-2018-3918 is a high-severity vulnerability in Samsung, classified under CWE-707. CVSS score: 7.5/10. Published 2018-08-27.

How severe is CVE-2018-3918?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Samsung

CVE-2018-3918

An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker can send an HTTP request to trigger this vulnerability.

EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Samsung — versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17
Samsung Sth-eth-250
Samsung Sth-eth-250_firmware — versions 0.20.17

Weakness classification (CWE)

CWE-707

References

talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-3918?: CVE-2018-3918 is a high-severity vulnerability in Samsung, classified under CWE-707. CVSS score: 7.5/10. Published 2018-08-27.
How severe is CVE-2018-3918?: High severity. CVSS v3 base score is 7.5 out of 10.