PT-2018-16283 · Yi · Yi Home Camera

Published 2018-11-02 · Updated 2023-02-02 · CVE-2018-3890

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yi Home Camera 27US version 1.8.7.0D

Description An exploitable code execution issue exists in the firmware update functionality. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this issue.

Recommendations For Yi Home Camera 27US version 1.8.7.0D, consider disabling the firmware update functionality via SD card insertion until a patch is available. Restrict access to the camera's firmware update module to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-3890

Affected Products

Yi Home Camera

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0565 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3890 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3890 · Vendor Advisory
• https://t.me/cvenotify/43407 · Telegram Post