CVE-2018-3875
CVE-2018-3875
Vexday Risk Score
28Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 9.9EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
10 set 2018Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy overflows the destination buffer, which has a size of 2,000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Samsung · SmartThings Hub STH-ETH-250Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →