CVE-2018-3934: Critical severity yitechnology yi home camera firmware vulnerability
Published Nov 2, 2018
·Updated
An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger this vulnerability.
Affected Software
2 affected components
Yitechnology Yi Home Camera Firmware=1.8.7.0d
Yitechnology Yi Home Camera
Event History
Nov 2, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-3934?
CVE-2018-3934 is classified as a high severity code execution vulnerability.
2
How do I fix CVE-2018-3934?
To fix CVE-2018-3934, update the Yi Home Camera firmware to the latest version beyond 1.8.7.0D.
3
What type of devices are affected by CVE-2018-3934?
CVE-2018-3934 affects the Yi Home Camera running firmware version 1.8.7.0D.
4
What can an attacker achieve with CVE-2018-3934?
An attacker can exploit CVE-2018-3934 to bypass authentication and execute code remotely.
5
Is there a way to mitigate the risks of CVE-2018-3934 without updating?
There are no effective mitigations for CVE-2018-3934 without applying the firmware update.