CVE-2018-3911

🗓️ 23 Aug 2018 22:00:00Reported by talosType

cve🔗 web.nvd.nist.gov👁 66 Views🌐 WEB

An HTTP header injection vulnerability in Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17 allows for partial control of requests

Reporter	Title	Published	Views	Family All 11
CNVD	Samsung SmartThings Hub HTTP Response Splitting Vulnerability	31 Jul 201800:00	–	cnvd
Cvelist	CVE-2018-3911	23 Aug 201822:00	–	cvelist
EUVD	EUVD-2018-15697	7 Oct 202500:30	–	euvd
NVD	CVE-2018-3911	23 Aug 201822:29	–	nvd
OSV	CVE-2018-3911	23 Aug 201822:29	–	osv
Prion	Design/Logic Flaw	23 Aug 201822:29	–	prion
Positive Technologies	PT-2018-16303 · Samsung · Samsung Smartthings Hub	23 Aug 201800:00	–	ptsecurity
seebug.org	Samsung SmartThings Hub hubCore Port 39500 HTTP Header Injection Vulnerability(CVE-2018-3911)	30 Jul 201800:00	–	seebug
Talos	Samsung SmartThings Hub hubCore Port 39500 HTTP Header Injection Vulnerability	26 Jul 201800:00	–	talos
Talos Blog	Vulnerability Spotlight: Multiple Vulnerabilities in Samsung SmartThings Hub	26 Jul 201808:06	–	talosblog

NVD

Vulners

Node

samsung sth-eth-250_firmwareMatch0.20.17

AND

samsung sth-eth-250Match-

[
  {
    "product": "Samsung",
    "vendor": "Samsung",
    "versions": [
      {
        "status": "affected",
        "version": "Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2018-0578

Parameter	Position	Path	Description	CWE
videoRequestType	request body	127.0.0.1:39500/videocore	HTTP header injection via JSON payload allows pipelined HTTP requests from hubCore to video-core /cameras endpoints.	CWE-113
cameraIds	request body	127.0.0.1:39500/videocore	HTTP header injection via JSON payload allows pipelined HTTP requests from hubCore to video-core /cameras endpoints.	CWE-113

21 Nov 2024 04:06Current

8.6High risk

Vulners AI Score8.6

CVSS 25

CVSS 3.18.6

CVSS 38.6

EPSS0.00639

CWE-113