Samsung Sth-Eth-250 Firmware vulnerabilities

CVE-2018-3919 [CRITICAL] CWE-787 CVE-2018-3919: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the "clips" table of its SQLite database, leading to a buffer overflow on the stack. An

CVE-2018-3893 [HIGH] CWE-787 CVE-2018-3893: An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to tr

CVE-2018-3865 [HIGH] CWE-120 CVE-2018-3865: An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "cameraIp" value in order to exploit this vulnerability.

CVE-2018-3894 [HIGH] CWE-120 CVE-2018-3894: An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "startTime" value in order to exploit this vulnerabil

CVE-2018-3864 [HIGH] CWE-120 CVE-2018-3864: An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "password" value in order to exploit this vulnerability.

CVE-2018-3897 [HIGH] CWE-120 CVE-2018-3897: An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-cor An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer,

CVE-2018-3896 [HIGH] CWE-120 CVE-2018-3896: An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-cor An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer,

CVE-2018-3911 [HIGH] CWE-113 CVE-2018-3911: An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThin An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated towar

CVE-2018-3876 [HIGH] CWE-120 CVE-2018-3876: An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit this vulnerability.

CVE-2018-3909 [HIGH] CWE-444 CVE-2018-3909: An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung Sm An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'onmessagecomplete' callback. An attacker can send a

CVE-2018-3918 [HIGH] CWE-707 CVE-2018-3918: An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - F An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker

CVE-2018-3908 [HIGH] CWE-444 CVE-2018-3908: An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung Sm An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body c

CVE-2018-3916 [HIGH] CWE-787 CVE-2018-3916: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can send an arbitrarily long 'directory' value in order to exp

CVE-2018-3914 [HIGH] CWE-787 CVE-2018-3914: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 2000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to

CVE-2018-3906 [HIGH] CWE-787 CVE-2018-3906: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vuln

CVE-2018-3912 [HIGH] CWE-787 CVE-2018-3912: On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey"

CVE-2018-3915 [HIGH] CWE-787 CVE-2018-3915: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit

CVE-2018-3913 [MEDIUM] CWE-787 CVE-2018-3913: An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to ex

CVE-2018-3927 [MEDIUM] CWE-295 CVE-2018-3927: An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binar An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitiv

CVE-2018-3926 [MEDIUM] CWE-191 CVE-2018-3926: An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the h An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process incorrectly handles malformed files existing in its data directory, leading to an infinite loop, which eventually causes the process to crash. An at