Samsung SmartThings Hub Integer Overflow Vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung South Korea. An integer overflow vulnerability exists in the ZigBee firmware update routine for the hubCore binary in Samsung SmartThings Hub, which stems from the hubCore process failing to properly handle malformed files in...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. samsungWifiScan handler is one of the WiFi network discovery handlers. A buffer overflow vulnerability exists in the samsungWifiScan handler of the video-core HT...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14290)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A stack buffer overflow vulnerability exists in the database 'find-by-cameraId' function of the video-core HTTP server in the Samsung SmartThings Hub, which...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14291)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A stack buffer overflow vulnerability exists in the samsungWifiScan callback notification of the video-core HTTP server in the Samsung SmartThings Hub, which ste...

Samsung SmartThings Hub hubCore Information Disclosure Vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung South Korea. A security vulnerability exists in the crash handler of the hubCore binary in Samsung SmartThings Hub, which originates from a program that sends logged minidumps to the backtrace.io service over an insecure HTTPS...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14286)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A buffer overflow vulnerability exists in the camera 'replace' function of the video-core HTTP server in the Samsung SmartThings Hub, which originates from the...

Samsung SmartThings Hub HTTP Response Splitting Vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung South Korea. An HTTP response splitting vulnerability exists in the remote server in Samsung SmartThings Hub with firmware version 0.20.17, which stems from the program failing to properly handle JSON messages. An attacker can...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14280)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A buffer overflow vulnerability exists in the credentials handler of the video-core HTTP server in the Samsung SmartThings Hub, which originates from the...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14285)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A stack buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server in Samsung SmartThings Hub, which originates from...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14292)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. samsungWifiScan handler is one of the WiFi network discovery handlers. A buffer overflow vulnerability exists in the samsungWifiScan handler of the video-core HT...

Samsung SmartThings Hub video-core HTTP server override vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A security vulnerability exists in the REST parser of the video-core HTTP server in the Samsung SmartThings Hub, which arises from the program's failure to...

Samsung SmartThings Hub video-core HTTP server injection vulnerability

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. An injection vulnerability exists in the credentials handler of the video-core HTTP server in the Samsung SmartThings Hub, which is caused by the program not...

Samsung SmartThings Hub video-core HTTP server buffer overflow vulnerability (CNVD-2018-14282)

Samsung SmartThings Hub is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A stack buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server in the Samsung SmartThings Hub, which originates...

Samsung SmartThings Hub hubCore Port 39500 HTTP Header Injection Vulnerability(CVE-2018-3911)

Summary An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controll...

Samsung SmartThings Hub video-core Camera URL Replace Code Execution Vulnerability(CVE-2018-3902)

Summary An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker...

Samsung SmartThings Hub video-core Database shard.videoHostURL Code Execution Vulnerability(CVE-2018-3906)

Summary An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on th...

Samsung SmartThings Hub hubCore port 39500 sync denial-of-service vulnerability(CVE-2018-3918)

Summary An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the "sync" operation, leading to arbitrary deleti...

Samsung SmartThings Hub video-core RTSP Configuration Command Injection Vulnerability(CVE-2018-3856)

Summary An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this...

Samsung SmartThings Hub video-core Camera Creation Code Execution Vulnerability(CVE-2018-3905)

Summary An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An...

Samsung SmartThings Hub hubCore Google Breakpad backtrace.io information disclosure vulnerability(CVE-2018-3927)

Summary An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to...