Yi Home Camera Code Execution Vulnerability (CNVD-2018-22813)

Yi Home Camera is an IoT home camera sold worldwide. A code execution vulnerability exists in the firmware update function of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a CRC conflict by inserting an SD card and exploiting the vulnerability via a specially crafted 7-Zip file, which c...

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules Vulnerability: Missing Authentication for Critical Function 2. REPOSTED INFORMATION This...

Design/Logic Flaw

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability...

CVE-2018-3890

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3920

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability...

CVE-2018-3890

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3934

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger...

CVE-2018-3934

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger...

Design/Logic Flaw

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger...

CVE-2018-3920

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability...

CVE-2018-3890

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3891

An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3890

Summary: CVE-2018-3890 affects Yi Home Camera 27US 1.8.7.0D. A local/physical vulnerability in the firmware update path allows code execution via a crafted SD-card payload. The root cause is in the firmware update workflow: a crafted file triggers a logic flaw and command injection through the ex...

CVE-2018-3934

The CVE-2018-3934 issue affects Yi Home Camera 27US, firmware 1.8.7.0D, via the firmware update path. Cisco Talos describes a nonce reuse/authentication bypass vulnerability in the p2p_tnp UDP protocol: an attacker sniffing traffic can craft UDP packets to trigger a logic flaw, bypass authenticat...

CVE-2018-3920

Vulnerability CVE-2018-3920 affects Yi Home Camera 27US with firmware 1.8.7.0D. A specially crafted 7-Zip file can trigger a CRC collision during firmware update via SD card, enabling local code execution on the device. Talos and NVD describe the impact as firmware-update abuse leading to arbitra...

CVE-2018-3920

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability...

CVE-2018-3891

Yi Home Camera 27US (firmware 1.8.7.0D) has a downgrade vulnerability in the firmware update function. A specially crafted SD-card file can bypass version checks and force an older firmware image to install, due to a logic flaw in the update flow (ver/key handling allows downgrade). Impact: poten...

CVE-2018-3934

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger...

Yi Home Camera Denial of Service Vulnerability

Yi Home Camera is an IoT home camera sold worldwide. A denial of service vulnerability exists in the firmware update feature in Yi Home Camera 27US 1.8.7.0D. An attacker can exploit the vulnerability by sending a specially crafted set of UDP packets to cause a change in settings, which can lead t...

PT-2018-16283 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera 27US version 1.8.7.0D Description: An exploitable code execution issue exists in the firmware update functionality. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker...