Code Execution Vulnerability in Yi Home Camera by Yi Technology
CVE-2018-3898

8.3HIGH

Key Information:

Vendor

Unknown

Status
Yi Technology
Vendor
CVE Published:
2 November 2018

What is CVE-2018-3898?

A vulnerability in the QR code scanning feature of the Yi Home Camera 27US 1.8.7.0D allows for code execution through a specifically crafted QR code. This vulnerability arises due to a buffer overflow when processing the trans_info call, which can overwrite a buffer exceeding the capacity, thereby enabling the execution of arbitrary code. Users are advised to update their device firmware to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

Yi Technology Yi Technology Home Camera 27US 1.8.7.0D

References

https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.