CyberSec.Space Logo
CVEブラウザに戻る

CVE-2018-3907

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.1920%
EPSS Percentile0.67th
Published2018年8月24日
Last Modified2024年11月21日

Vulnerability Description

An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'on_url' callback. An attacker can send an HTTP request to trigger this vulnerability.

Affected Platforms (CPE)

💻
Samsung

Sth Eth 250 Firmware

= 0.20.17

References & Advisories

🔗 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577
🔗 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0577

関連する脆弱性情報

CVE-2018-38639.9

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields f...

CVE-2018-38789.9

Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung Smart...

CVE-2018-38679.9

An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP ...

CVE-2018-39029.9

An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartTh...