Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Samsung SmartThings Hub could allow remote code execution

CVE-2018-3867 · published 8 years ago
Summary

The SmartThings Hub model STH-ETH-250 running firmware 0.20.17 has a flaw in its video-core web service that can be triggered by specially crafted HTTP requests. An attacker could exploit this to run unauthorized code on the hub. Update the device with the latest firmware from Samsung as soon as it is available, or contact Samsung support for guidance if a patch is not yet released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
samsung sth-eth-250_firmware 0.20.17
cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*
Original advisory text
An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware...
An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly handles the answer received from a smart camera, leading to a buffer overflow on the stack. An attacker can send a series of HTTP requests to trigger this vulnerability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Aug 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-3867 · NVD
Track software like this
Free during beta