Buffer Overflow Vulnerability in Samsung SmartThings Hub Devices

CVE-2018-3925

Summary

A buffer overflow vulnerability has been identified in the video-core process of Samsung's SmartThings Hub STH-ETH-250 devices, specifically in the handling of HTTP communications with remote video-host servers. This vulnerability arises due to the insecure parsing of the AWSELB cookie, which can potentially be exploited by a malicious actor impersonating remote HTTP servers. If successfully executed, this could lead to a buffer overflow on the heap, allowing unauthorized access or manipulation of the device.

References