CVE-2018-3925

An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250…

High · published August 23, 2018

CVSS v3.0
8.5
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-host servers, leading to a buffer overflow on the heap. An attacker able to impersonate the remote HTTP servers could trigger this vulnerability.

The record
Technical detail
CVSS v3.0
8.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01475 · 73.6th percentile
Published
2018-08-23T15:00Z
EPSS history
Timeline
  • 23 AUG 15:00Z
    An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250…
    cvelistv5