CVE-2018-3917 - CVE House
Back to Database
Status published High CVE-2018-3917

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17,...

Vulnerability Description

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The strcpy call overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long "region" value in order to exploit this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-3917

Credits & Attribution

No credits recorded in the NVD database.

References

More from Samsung

View All →
CVE-2025-2233
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability
High 8.8
CVE-2024-32670
Exposure of Sensitive Information to an Unauthorized Actor in Samsung...
High 7
CVE-2022-1230
This vulnerability allows local attackers to execute arbitrary code on...
Low 3.9
CVE-2020-8899
Memory corruption in Quram library when decoding qmg can lead to RCE
Critical 10
CVE-2020-8860
This vulnerability allows remote attackers to execute arbitrary code on...
High 7.1

Affected Vendor

Affected Software

SmartThings Hub STH-ETH-250
Vulnerable Versions:
Firmware version 0.20.17

Timeline

Official Publish: August 23rd, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.