PT-2018-16250 · Samsung · Samsung Smartthings Hub

CVE-2018-3856 · Publicado 2018-08-23 · Atualizado 2022-12-03

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 version 0.20.17

Description The issue arises from the device's incorrect handling of spaces in the URL field of the smart cameras RTSP configuration, leading to an arbitrary operating system command injection. An attacker can exploit this by sending a series of HTTP requests.

Recommendations For Samsung SmartThings Hub STH-ETH-250 version 0.20.17, consider restricting access to the RTSP configuration to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using spaces in the URL field. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2018-3856

Produtos afetados

Samsung Smartthings Hub

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0539 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3856 · Nota de Segurança
• https://t.me/cvenotify/39048 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-3856 · Aviso do Fabricante