CVE-2018-3909

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, 'onmessagecomplete' callback. An attacker can send an HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-39108.0An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. A specially craftedCVE-2018-39118.6An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.CVE-2018-39127.8On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theCVE-2018-39136.7An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39147.8An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39158.2An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39167.8An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39179.9On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theCVE-2018-39187.5An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore proCVE-2018-39199.9An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SCVE-2018-39206.8An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially craCVE-2018-39217.8A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PSD image pr
CVE-2018-3909: High severity, CVSS 8.6 | Vulnix