PT-2018-16312 · Yi · Yi Home Camera

Published 2018-11-02 · Updated 2023-02-02 · CVE-2018-3920

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yi Home Camera version 1.8.7.0D

Description An exploitable code execution issue exists in the firmware update functionality. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SD card to trigger this issue.

Recommendations For Yi Home Camera version 1.8.7.0D, consider disabling the firmware update functionality via SD card until a patch is available. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2018-3920

Affected Products

Yi Home Camera

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0584 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3920 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3920 · Vendor Advisory
• https://t.me/cvenotify/43411 · Telegram Post