Vulnerabilities (CVE)

Filtered by vendor Samsung Subscribe
Filtered by product Sth-eth-250
Total 40 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-3867 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera, leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVE-2018-3908 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 6.4 MEDIUM 7.5 HIGH
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body callback, defined by sub_41734, an attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3874 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to exploit this vulnerability.
CVE-2018-3896 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 8.8 HIGH
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "correlationId" value in order to exploit this vulnerability.
CVE-2018-3877 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 160 bytes. An attacker can send an arbitrarily long "directory" value in order to exploit this vulnerability.
CVE-2018-3902 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3925 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the remote video-host communication of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely parses the AWSELB cookie while communicating with remote video-host servers, leading to a buffer overflow on the heap. An attacker able to impersonate the remote HTTP servers could trigger this vulnerability.
CVE-2018-3903 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call overflows the destination buffer, which has a size of 512 bytes. An attacker can send an arbitrarily long "url" value in order to overwrite the saved-PC with 0x42424242.
CVE-2018-3904 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3927 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 4.3 MEDIUM 5.9 MEDIUM
An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.
CVE-2018-3879 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 6.5 MEDIUM 8.8 HIGH
An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in turn leads to a SQL injection in the video-core database. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVE-2018-3897 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 8.8 HIGH
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "callbackUrl" value in order to exploit this vulnerability.
CVE-2018-3907 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 6.4 MEDIUM 10.0 CRITICAL
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'on_url' callback. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3864 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 8.8 HIGH
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "password" value in order to exploit this vulnerability.
CVE-2018-3905 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the camera "create" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the "state" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3856 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVE-2018-3912 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 6.9 MEDIUM 7.8 HIGH
On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. The strcpy call overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey" value in order to exploit this vulnerability.
CVE-2018-3865 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 8.8 HIGH
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "cameraIp" value in order to exploit this vulnerability.
CVE-2018-3872 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2018-3875 1 Samsung 2 Sth-eth-250, Sth-eth-250 Firmware 2023-12-10 9.0 HIGH 9.9 CRITICAL
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy overflows the destination buffer, which has a size of 2,000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.