CVE-2018-3916: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings…

PriorityP340high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.39%

31.1th percentile

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can send an arbitrarily long 'directory' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
samsung	samsung	—	—
samsung	sth-eth-250_firmware	—	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv3.07.5HIGHCVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.