CVE-2018-3918

HIGH

Samsung SmartThings Hub STH-ETH-250 - Firmware 0.20.17 - RCE

Title source: llm

Description

An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker can send an HTTP request to trigger this vulnerability.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0582

Scores

CVSS v3 7.5

EPSS 0.0099

EPSS Percentile 57.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-707

Status published

Products (1)

samsung/sth-eth-250_firmware 0.20.17

Published Aug 27, 2018

Tracked Since Feb 18, 2026