PT-2018-16308 · Samsung · Samsung Smartthings Hub

Published 2018-08-28 · Updated 2023-05-16 · CVE-2018-3916

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17

Description A stack-based buffer overflow issue exists in the video-core HTTP server of the Samsung SmartThings Hub. This occurs due to a strcpy call that overflows a destination buffer of 136 bytes. An attacker can exploit this by sending an HTTP request with an arbitrarily long 'directory' value.

Recommendations For Firmware version 0.20.17, consider restricting access to the video-core HTTP server until a patch is available. As a temporary workaround, avoid using arbitrarily long 'directory' values in HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-3916

Affected Products

Samsung Smartthings Hub

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0581 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3916 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3916 · Vendor Advisory