PT-2018-16292 · Yi · Yi Home Camera

CVE-2018-3899 · Publicado 2018-11-02 · Atualizado 2023-02-02

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yi Home Camera 27US version 1.8.7.0D

Description An exploitable code execution issue exists in the QR code scanning functionality. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the password dst field.

Recommendations For version 1.8.7.0D, as a temporary workaround, consider disabling the QR code scanning functionality until a patch is available. Restrict access to the trans info call to minimize the risk of exploitation. Avoid using the password dst field in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2018-3899

Produtos afetados

Yi Home Camera

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3899 · Aviso do Fabricante
• https://t.me/cvenotify/43415 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-3899 · Nota de Segurança