PT-2018-16292 · Yi · Yi Home Camera

Published 2018-11-02 · Updated 2023-02-02 · CVE-2018-3899

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yi Home Camera 27US version 1.8.7.0D

Description An exploitable code execution issue exists in the QR code scanning functionality. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the password dst field.

Recommendations For version 1.8.7.0D, as a temporary workaround, consider disabling the QR code scanning functionality until a patch is available. Restrict access to the trans info call to minimize the risk of exploitation. Avoid using the password dst field in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2018-3899

Affected Products

Yi Home Camera

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3899 · Security Note
• https://t.me/cvenotify/43415 · Telegram Post