What is CVE-2018-3927?

CVE-2018-3927 is a medium-severity vulnerability in Samsung, classified under Improper Certificate Validation. CVSS score: 6.8/10. Published 2018-08-27.

How severe is CVE-2018-3927?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Samsung

CVE-2018-3927

An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.

Vulnerability class: Improper Certificate Validation

EPSS: 0.011 (63.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Samsung — versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17
Samsung Sth-eth-250
Samsung Sth-eth-250_firmware — versions 0.20.17

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

talos-cna@cisco.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-3927?: CVE-2018-3927 is a medium-severity vulnerability in Samsung, classified under Improper Certificate Validation. CVSS score: 6.8/10. Published 2018-08-27.
How severe is CVE-2018-3927?: Medium severity. CVSS v3 base score is 6.8 out of 10.