CVE-2018-3920: High severity yitechnology yi home camera firmware vulnerability

Published Nov 2, 2018

Updated

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability.

Affected Software

2 affected components

Yitechnology Yi Home Camera Firmware=1.8.7.0d

Yitechnology Yi Home Camera

Event History

Nov 2, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3920?

CVE-2018-3920 has been classified as a high-severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2018-3920?

To fix CVE-2018-3920, ensure that your Yi Home Camera firmware is updated to the latest version provided by Yitechnology.

Who is affected by CVE-2018-3920?

The vulnerability CVE-2018-3920 affects users of the Yi Home Camera with firmware version 1.8.7.0D.

What type of vulnerability is CVE-2018-3920?

CVE-2018-3920 is a code execution vulnerability that can be exploited through a malicious firmware update.

What can an attacker do with CVE-2018-3920?

An attacker exploiting CVE-2018-3920 can insert a specially crafted SD card to trigger a firmware update and execute arbitrary code.