Buffer Overflow Vulnerability in Samsung SmartThings Hub Firmware

CVE-2018-3917

Summary

A vulnerability exists in Samsung SmartThings Hub devices where the video-core process improperly handles data when extracting fields from the SQLite database's 'shard' table. This issue occurs on devices running firmware version 0.20.17, allowing an attacker to exploit the vulnerability by sending crafted HTTP requests. Specifically, the strcpy function's inadequate buffer size of 16 bytes can lead to a buffer overflow on the stack. This flaw permits the submission of an excessively long 'region' value, which can compromise device security and integrity.

References