CVE-2018-3919

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process insecurely extracts the fields from the "clips" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.

Affected products

Sqlite, Samsung Smartthings Hub

Samsung sth-eth-250 Firmware

= 0.20.17

CVSS 3.1

9.9 CRITICAL

EPSS

0.9% (58th percentile)

Weakness

CWE-787

NVD status

Modified

Published

2018-08-23