CVE-2018-3926

 

Published at: - 28-08-2018 07:29

Last modified: - 19-04-2022 08:15

Total changes: - 2

Description

An exploitable integer underflow vulnerability exists in the ZigBee firmware update routine of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process incorrectly handles malformed files existing in its data directory, leading to an infinite loop, which eventually causes the process to crash. An attacker can send an HTTP request to trigger this vulnerability.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0593
• 105162-Third Party Advisory, VDB Entry

 

Keywords

NVD

 

CVE-2018-3926

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures