Stack-Based Buffer Overflow in Samsung SmartThings Hub HTTP Server
CVE-2018-3915

7.5HIGH

Key Information:

Vendor
Samsung
Status
Smartthings Hub Sth-eth-250
Vendor
CVE Published:
21 September 2018

Summary

A stack-based buffer overflow vulnerability exists in the Samsung SmartThings Hub's video-core HTTP server, specifically during the retrieval of database fields. This flaw occurs due to an improper handling of input, where the strcpy function allows for the overflow of a fixed destination buffer of 64 bytes. An attacker can exploit this vulnerability by sending an excessively long 'bucket' value, potentially executing arbitrary code and compromising the device's integrity.

Affected Version(s)

SmartThings Hub STH-ETH-250 Firmware version 0.20.17

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.