CVE-2018-3905: Buffer Overflow
An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3905?
CVE-2018-3905 is considered a high severity vulnerability due to the potential for remote code execution via a buffer overflow.
How do I fix CVE-2018-3905?
To mitigate CVE-2018-3905, update the Samsung SmartThings Hub STH-ETH-250 to a firmware version beyond 0.20.17.
What devices are affected by CVE-2018-3905?
CVE-2018-3905 affects Samsung SmartThings Hub STH-ETH-250 devices running firmware version 0.20.17.
What kind of attack can exploit CVE-2018-3905?
CVE-2018-3905 can be exploited using crafted HTTP requests that leverage the buffer overflow in the camera "create" feature.
Is there a public exploit available for CVE-2018-3905?
Yes, there are indications that proofs of concept for exploiting CVE-2018-3905 may exist due to its severity.