CVE-2018-3867

An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera...

CVE-2018-3919

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the "clips" table of its SQLite...

CVE-2018-3925

An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-hos...

CVE-2018-3878

Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buff...

CVE-2018-3867

An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera...

CVE-2018-3879

An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in...

CVE-2018-3919

CVE-2018-3919 affects Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). The vulnerability is a stack-based buffer overflow in video-core HTTP server when retrieving fields from the SQLite clips table. The function copies data into per-field buffers (max 512 bytes) without length checks, all...

CVE-2018-3867

CVE-2018-3867 describes a stack-based buffer overflow in Samsung SmartThings Hub (STH-ETH-250) video-core HTTP server. The vulnerability exists in the samsungWifiScan callback handling during camera discovery, where the hub constructs a POST to a callback URL using an unconstrained camera respons...

CVE-2018-3878

Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17 contains multiple buffer overflow vulnerabilities in the video-core HTTP server credentials handler. Specifically, CVE-2018-3873 through CVE-2018-3878 arise from user-controlled JSON, where a strncpy copies a string without length checks, ...

CVE-2018-3917

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The...

CVE-2018-3902

An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a...

CVE-2018-3879

CVE-2018-3879 describes a JSON injection in Samsung SmartThings Hub video-core’s credentials handler that leads to a SQL injection in the SQLite database. Affected device: Samsung SmartThings Hub STH-ETH-250 with firmware 0.20.17. Root cause: the video-core HTTP server parses user-controlled JSON...

CVE-2018-3902

CVE-2018-3902 affects Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17) with a buffer overflow in the video-core HTTP server’s camera Replace feature. The code copies the user-controlled JSON field url using memcpy without length checks, overflowing a stack buffer and enabling potential co...

CVE-2018-3905

CVE-2018-3905 applies to Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17). The video-core HTTP server’s camera-create path mishandles the JSON field state, copying it into a stack buffer without size checks, causing a stack-based buffer overflow that can enable code execution when a crafted...

CVE-2018-3925

CVE-2018-3925 affects Samsung SmartThings Hub STH-ETH-250, specifically the video-core HTTP server. The vulnerability arises from insecure parsing of the AWSELB cookie in remote video-host communications, copying the cookie value into a heap buffer without length checks, resulting in a heap-based...

CVE-2018-3863

Summary: CVE-2018-3863 covers buffer-overflow vulnerabilities in Samsung SmartThings Hub video-core (STH-ETH-250) firmware 0.20.17. The /samsungWifiScan HTTP POST parses a user-controlled JSON payload and copies JSON-string values to 40-byte buffers using strcpy, without bounding, enabling stack ...

CVE-2018-3863

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows t...

CVE-2018-3917

CVE-2018-3917 (and related TALOS/CNA entries) affects Samsung SmartThings Hub STH-ETH-250 firmware 0.20.17. The video-core HTTP server reads shard table fields (region among others) from SQLite and copies them with strcpy into fixed-size buffers, causing a stack-based buffer overflow when arbitra...

CVE-2018-3903

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call...

CVE-2018-3903

Samsung SmartThings Hub STH-ETH-250 (firmware 0.20.17) is affected by video-core HTTP server buffer overflows (CVE-2018-3903/3904). The vulnerability stems from copying user-controlled JSON fields (url or state) into a 512-byte stack buffer using memcpy, with the length derived from the source st...