Firmware Downgrade Vulnerability in Yi Home Camera by YI Technology
CVE-2018-3891

5.7MEDIUM

Key Information:

Vendor

Unknown

Status
Yi Technology
Vendor
CVE Published:
2 November 2018

What is CVE-2018-3891?

A vulnerability exists in the firmware update process of the Yi Home Camera 27US 1.8.7.0D. This flaw allows attackers to downgrade the firmware by exploiting a logic error triggered through the insertion of a specially crafted SD card. This means that if an attacker successfully executes the downgrade, they could restore an older, potentially less secure version of the firmware, putting the device and its users at risk.

Affected Version(s)

Yi Technology Yi Technology Home Camera 27US 1.8.7.0D

References

https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.