Buffer Overflow in Samsung SmartThings Hub Credentials Handler
CVE-2018-3876

9.9CRITICAL

Key Information:

Vendor
Samsung
Status
Smartthings Hub Sth-eth-250
Vendor
CVE Published:
21 September 2018

Summary

A buffer overflow vulnerability is present in the credentials handler of the Samsung SmartThings Hub's HTTP server. This vulnerability is caused by the usage of strncpy, which does not appropriately limit the size of the buffer during data copying. As a result, an attacker can provide an excessively long 'bucket' value, potentially leading to the corruption of memory and unauthorized access, or other unintended behavior within the system.

Affected Version(s)

SmartThings Hub STH-ETH-250 Firmware version 0.20.17

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.