Firmware Downgrade Vulnerability in Yi Home Camera by Yi Technology
CVE-2018-3892

9.6CRITICAL

Key Information:

Vendor

Unknown

Status
Yi Technology
Vendor
CVE Published:
2 November 2018

What is CVE-2018-3892?

A firmware downgrade vulnerability in the time syncing functionality of the Yi Home Camera 27US 1.8.7.0D can be exploited through specially crafted network packets. This vulnerability can induce a buffer overflow, allowing an attacker to execute arbitrary code. By intercepting and modifying network traffic, malicious actors can trigger this vulnerability, potentially compromising the device and the connected network security.

Affected Version(s)

Yi Technology Yi Technology Home Camera 27US 1.8.7.0D

References

https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.