CVE-2018-3856: Command Injection
An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3856?
CVE-2018-3856 is classified as a critical vulnerability due to the potential for arbitrary command injection.
How do I fix CVE-2018-3856?
To mitigate CVE-2018-3856, update the firmware of the Samsung SmartThings Hub to the latest version that addresses this vulnerability.
What devices are affected by CVE-2018-3856?
CVE-2018-3856 specifically affects the Samsung SmartThings Hub STH-ETH-250 running firmware version 0.20.17.
What type of attack can be executed through CVE-2018-3856?
CVE-2018-3856 allows attackers to execute arbitrary operating system commands through crafted HTTP requests.
Is CVE-2018-3856 still a threat if the device is secured behind a firewall?
While a firewall can provide some protection, CVE-2018-3856 remains a threat if the vulnerability is present in the device itself.