CVE-2018-3910: Command Injection

Published Nov 1, 2018

Updated

An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted SSID can cause a command injection, resulting in code execution. An attacker can cause a camera to connect to this SSID to trigger this vulnerability. Alternatively, an attacker can convince a user to connect their camera to this SSID.

Affected Software

3 affected components

Yitechnology Yi Home Camera Firmware=1.8.7.0d

Yitechnology Yi Home Camera

Yitechnology Yi Home

Event History

Nov 1, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3910?

CVE-2018-3910 has been classified as a critical severity vulnerability due to its potential for remote code execution.

How does the CVE-2018-3910 vulnerability work?

CVE-2018-3910 exploits a command injection vulnerability triggered by a specially crafted SSID that the Yi Home Camera connects to.

Who is affected by CVE-2018-3910?

CVE-2018-3910 affects users of Yi Home Camera running firmware version 1.8.7.0D.

How can I fix CVE-2018-3910?

To mitigate CVE-2018-3910, users should update their Yi Home Camera firmware to the latest version provided by the manufacturer.

What should I do if I cannot update my device to fix CVE-2018-3910?

If updating is not possible, disconnect the Yi Home Camera from any Wi-Fi networks to avoid potential exploitation of CVE-2018-3910.