CVE-2018-3911

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-113

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-39127.8On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theCVE-2018-39136.7An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39147.8An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39158.2An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39167.8An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the SamCVE-2018-39179.9On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from theCVE-2018-39187.5An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore proCVE-2018-39199.9An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in video-core's HTTP server of Samsung SCVE-2018-39206.8An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially craCVE-2018-39217.8A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PSD image prCVE-2018-39227.8A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially crafted ANI image prCVE-2018-39237.8A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PCX image pr