CVE-2018-3927

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Samsung	Samsung	Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0594Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0594Exploit, Third Party Advisory

Timeline

Published: Aug 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-39287.5An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted CVE-2018-39297.8An exploitable heap corruption exists in the PowerPoint document conversion functionality of the Antenna House Office Server Document Conver CVE-2018-39307.8In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document CVE-2018-39317.8In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document CVE-2018-39327.8An exploitable stack-based buffer overflow exists in the Microsoft Word document conversion functionality of the Antenna House Office Server CVE-2018-39337.8An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Documen CVE-2018-39349.8An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted CVE-2018-39357.5An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set CVE-2018-39367.8In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document CVE-2018-39377.2An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 f CVE-2018-393810.0An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 CVE-2018-39398.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially