CVE-2018-3878: Buffer Overflow
Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. A strncpy overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long "region" value in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3878?
CVE-2018-3878 is considered a critical vulnerability due to the exploitable buffer overflow issues.
How do I fix CVE-2018-3878?
To fix CVE-2018-3878, update the firmware of your Samsung SmartThings Hub to the latest version.
What systems are affected by CVE-2018-3878?
CVE-2018-3878 affects Samsung SmartThings Hub STH-ETH-250 devices running firmware version 0.20.17.
What happens if CVE-2018-3878 is exploited?
Exploitation of CVE-2018-3878 can lead to arbitrary code execution through buffer overflow vulnerabilities.
Is there a workaround for CVE-2018-3878?
There are no documented workarounds for CVE-2018-3878; updating the firmware is the recommended solution.