Unknown Yi Technology vulnerabilities

CVE-2018-3934 [CRITICAL] CVE-2018-3934: An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home C An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger this vulnerability.

CVE-2018-3898 [HIGH] CWE-120 CVE-2018-3898: An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans_info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the ssid_dst field.

CVE-2018-3892 [HIGH] CWE-120 CVE-2018-3892: An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home An exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted packet can cause a buffer overflow, resulting in code execution. An attacker can intercept and alter network traffic to trigger this vulnerability.

CVE-2018-3899 [HIGH] CWE-120 CVE-2018-3899: An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans_info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the password_dst field

CVE-2018-3935 [HIGH] CWE-400 CVE-2018-3935: An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camer An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can allocate unlimited memory, resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability.

CVE-2018-3890 [MEDIUM] CWE-78 CVE-2018-3890: An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home C An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability.

CVE-2018-3920 [MEDIUM] CVE-2018-3920: An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Ho An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability.

CVE-2018-3891 [MEDIUM] CVE-2018-3891: An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Ho An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.