CVE-2018-3911 - CVE House
Back to Database
Status published High CVE-2018-3911

An exploitable HTTP header injection vulnerability exists in the remote...

Vulnerability Description

An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-3911

Credits & Attribution

No credits recorded in the NVD database.

References

More from Samsung

View All →
CVE-2025-2233
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability
High 8.8
CVE-2024-32670
Exposure of Sensitive Information to an Unauthorized Actor in Samsung...
High 7
CVE-2022-1230
This vulnerability allows local attackers to execute arbitrary code on...
Low 3.9
CVE-2020-8899
Memory corruption in Quram library when decoding qmg can lead to RCE
Critical 10
CVE-2020-8860
This vulnerability allows remote attackers to execute arbitrary code on...
High 7.1

Affected Vendor

Affected Software

Samsung
Vulnerable Versions:
Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17

Timeline

Official Publish: August 23rd, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.