Stack overflow

An exploitable stack-based buffer overflow vulnerability exists in the database 'find-by-cameraId' functionality of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles existing records inside its SQLite database,...

CVE-2018-3856

An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of...

CVE-2018-3856

CVE-2018-3856 affects Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). Cisco Talos reports an OS command-injection in the video-core RTSP handling: if the camera-password contains spaces, the hub builds an ffmpeg command with attacker-controlled options, leading to arbitrary code execution...

CVE-2018-3866

The CVE-2018-3866 issue affects Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17) in the video-core HTTP server’s samsungWifiScan handler. The root cause is unsafe handling of user-supplied JSON payloads: a strcpy copies json-derived strings (including callbackUrl) into fixed 40-byte buffers...

CVE-2018-3880

CVE-2018-3880 affects Samsung SmartThings Hub STH-ETH-250 with Firmware 0.20.17. The vulnerability is a stack-based buffer overflow in the video-core HTTP server’s database function find-by-cameraId, triggered by crafting HTTP requests that interact with the SQLite data when deleting/handling cam...

CVE-2018-3911

CVE-2018-3911 affects Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). The hubCore process listens on port 39500 and forwards unauthenticated JSON to remote SmartThings servers, which mishandle JSON and can inject CRLF into HTTP requests sent to the internal video-core HTTP server. This en...

CVE-2018-3912

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128...

CVE-2018-3912

CVE-2018-3912 affects Samsung SmartThings Hub STH-ETH-250 firmware 0.20.17. The video-core HTTP server copies database fields from shard into a stack-allocated structure using strcpy without length checks, enabling stack-based buffer overflows (secretKey, plus other fields with varying sizes). An...

CVE-2018-3867

CVE-2018-3867 describes a stack-based buffer overflow in Samsung SmartThings Hub (STH-ETH-250) video-core HTTP server. The vulnerability exists in the samsungWifiScan callback handling during camera discovery, where the hub constructs a POST to a callback URL using an unconstrained camera respons...

CVE-2018-3878

Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17 contains multiple buffer overflow vulnerabilities in the video-core HTTP server credentials handler. Specifically, CVE-2018-3873 through CVE-2018-3878 arise from user-controlled JSON, where a strncpy copies a string without length checks, ...

CVE-2018-3879

CVE-2018-3879 describes a JSON injection in Samsung SmartThings Hub video-core’s credentials handler that leads to a SQL injection in the SQLite database. Affected device: Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17. Root cause: the video-core HTTP server parses user-controlled JSON...

CVE-2018-3917

CVE-2018-3917 (and related TALOS/CNA entries) affects Samsung SmartThings Hub STH-ETH-250 firmware 0.20.17. The video-core HTTP server reads shard table fields (region among others) from SQLite and copies them with strcpy into fixed-size buffers, causing a stack-based buffer overflow when arbitra...

CVE-2018-3863

Summary: CVE-2018-3863 covers buffer-overflow vulnerabilities in Samsung SmartThings Hub video-core (STH-ETH-250) firmware 0.20.17. The /samsungWifiScan HTTP POST parses a user-controlled JSON payload and copies JSON-string values to 40-byte buffers using strcpy, without bounding, enabling stack ...

CVE-2018-3903

Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17) is affected by video-core HTTP server buffer overflows (CVE-2018-3903/3904). The vulnerability stems from copying user-controlled JSON fields (url or state) into a 512-byte stack buffer using memcpy, with the length derived from the source st...

CVE-2018-3905

CVE-2018-3905 applies to Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). The video-core HTTP server’s camera-create path mishandles the JSON field state, copying it into a stack buffer without size checks, causing a stack-based buffer overflow that can enable code execution when a crafted...

PT-2018-16303 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: An exploitable HTTP header injection issue exists in the remote servers of the Samsung SmartThings Hub. The hubCore process listens on port 39500 and relays any unauthenticated...

CVE-2018-3856: Improper Neutralization of Argument Delimiters in a Command

An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of...

CVE-2018-3863: Out-of-bounds Write

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows t...

CVE-2018-3872: Improper Restriction of Operations within the Bounds of a Memory Buffer

An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload, leading to a buffer...

CVE-2018-3911: Improper Neutralization of CRLF Sequences in HTTP Headers

An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages...