CVE-2018-3927 — MEDIUM (6.8)

Vulnerability Description

An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.

CVSS Score

6.8

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Samsung	Sth-Eth-250 Firmware	0.20.17
Samsung	Sth-Eth-250	-

Related Weaknesses (CWE)

CWE-295

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0594ExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0594ExploitThird Party Advisory

FAQ

What is CVE-2018-3927?

CVE-2018-3927 is a vulnerability with a CVSS score of 6.8 (MEDIUM). An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Googl...

How severe is CVE-2018-3927?

CVE-2018-3927 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-3927?

Check the references section above for vendor advisories and patch information. Affected products include: Samsung Sth-Eth-250 Firmware, Samsung Sth-Eth-250.