PT-2018-16310 · Samsung · Samsung Smartthings Hub

CVE-2018-3918 · Publicado 2018-08-27 · Atualizado 2023-05-16

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 version 0.20.17

Description An issue exists in the remote servers of Samsung SmartThings Hub where the hubCore process listens on port 39500 and relays unauthenticated messages. The servers incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker can send an HTTP request to trigger this issue.

Recommendations For Samsung SmartThings Hub STH-ETH-250 version 0.20.17, consider restricting access to the hubCore process on port 39500 until a patch is available. As a temporary workaround, avoid using the 'sync' operation for camera IDs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Improper Neutralization

Enumeração de Fraquezas

CWE-707

Identificadores relacionados

CVE-2018-3918

Produtos afetados

Samsung Smartthings Hub

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0582 · Exploit
• https://t.me/cvenotify/50554 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-3918 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3918 · Aviso do Fabricante