CVE-2018-3872: Buffer Overflow
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3872?
CVE-2018-3872 is classified as a critical severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2018-3872?
To fix CVE-2018-3872, you should update the Samsung SmartThings Hub to the latest firmware version that addresses this vulnerability.
Who is affected by CVE-2018-3872?
CVE-2018-3872 affects users running Samsung SmartThings Hub firmware version 0.20.17.
What causes CVE-2018-3872?
CVE-2018-3872 is caused by a buffer overflow in the credentials handler of the video-core HTTP server due to improper handling of user-controlled JSON payloads.
Can CVE-2018-3872 be exploited remotely?
Yes, CVE-2018-3872 can be exploited remotely, allowing attackers to send malicious JSON payloads to the affected device.