PT-2018-16318 · Samsung · Samsung Smartthings Hub

Published 2018-08-28 · Updated 2023-03-04 · CVE-2018-3926

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17

Description The issue is related to an integer underflow vulnerability in the ZigBee firmware update routine of the hubCore binary. This vulnerability is triggered when the hubCore process incorrectly handles malformed files in its data directory, leading to an infinite loop and eventually causing the process to crash. An attacker can exploit this by sending a specifically crafted HTTP request.

Recommendations For Firmware version 0.20.17, as a temporary workaround, consider restricting access to the hubCore binary until a patch is available. Avoid using the vulnerable firmware update routine in the ZigBee protocol until the issue is resolved.

Exploit

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2018-3926

Affected Products

Samsung Smartthings Hub

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0593 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3926 · Security Note
• http://securityfocus.com/bid/105162 · Note