PT-2018-16318 · Samsung · Samsung Smartthings Hub

CVE-2018-3926 · Publicado 2018-08-28 · Atualizado 2023-03-04

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17

Description The issue is related to an integer underflow vulnerability in the ZigBee firmware update routine of the hubCore binary. This vulnerability is triggered when the hubCore process incorrectly handles malformed files in its data directory, leading to an infinite loop and eventually causing the process to crash. An attacker can exploit this by sending a specifically crafted HTTP request.

Recommendations For Firmware version 0.20.17, as a temporary workaround, consider restricting access to the hubCore binary until a patch is available. Avoid using the vulnerable firmware update routine in the ZigBee protocol until the issue is resolved.

Exploit

Correção

Integer Underflow

Enumeração de Fraquezas

CWE-191

Identificadores relacionados

CVE-2018-3926

Produtos afetados

Samsung Smartthings Hub

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0593 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3926 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3926 · Nota de Segurança
• http://securityfocus.com/bid/105162 · Nota