CVE-2018-3902

An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices…

Critical · published August 23, 2018

CVSS v3.0
9.9
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

🔥 A buffer overflow vulnerability in the Samsung SmartThings Hub’s camera feature could let attackers hijack your device! Think of it like a waiter misplacing an order at a restaurant — if they don’t double-check the order details, they could accidentally fill the wrong dish, causing chaos in the kitchen! In this case, the video-core process is the waiter, and the URL is the order being taken. If exploited, this vulnerability could allow attackers to overwrite critical data, potentially leading to device crashes or unauthorized access to your smart home system. Imagine a malicious chef taking control of your kitchen, manipulating devices, and causing mayhem right in your living room!

Put simply

Think of it like a waiter misplacing an order at a restaurant — if they don’t double-check the order details, they could accidentally fill the wrong dish, causing chaos in the kitchen! In this case, the video-core process is the waiter, and the URL is the order being taken. This vulnerability arises from an improper extraction of the URL field from a user-controlled JSON payload, causing a buffer overflow on the stack when an attacker sends a specially crafted HTTP request.

What to do

If exploited, this vulnerability could allow attackers to overwrite critical data, potentially leading to device crashes or unauthorized access to your smart home system. Imagine a malicious chef taking control of your kitchen, manipulating devices, and causing mayhem right in your living room! Immediate action is crucial! Update your Samsung SmartThings Hub to the latest firmware version provided by Samsung to mitigate this vulnerability. Ensure that all security settings are enabled to help protect your smart home devices. You've got this! Stay vigilant, follow these steps, and your smart home will be safer in no time! 🛡️

The record
Technical detail
CVSS v3.0
9.9 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01753 · 77.6th percentile
Published
2018-08-23T15:00Z
EPSS history
Timeline
  • 23 AUG 15:00Z
    An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices…
    cvelistv5