PT-2018-16250 · Samsung · Samsung Smartthings Hub

Published 2018-08-23 · Updated 2022-12-03 · CVE-2018-3856

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 version 0.20.17

Description The issue arises from the device's incorrect handling of spaces in the URL field of the smart cameras RTSP configuration, leading to an arbitrary operating system command injection. An attacker can exploit this by sending a series of HTTP requests.

Recommendations For Samsung SmartThings Hub STH-ETH-250 version 0.20.17, consider restricting access to the RTSP configuration to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using spaces in the URL field. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2018-3856

Affected Products

Samsung Smartthings Hub

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0539 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3856 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3856 · Vendor Advisory
• https://t.me/cvenotify/39048 · Telegram Post