CVE-2018-3878

Vulnerability

The video-core process in Samsung SmartThings Hub STH-ETH-250 firmware version 0.20.17 contains a stack buffer overflow in the credentials handler of its HTTP server. When parsing a JSON payload, the strncpy function copies the user-supplied "region" value into a fixed 16-byte stack buffer without proper bounds checking, leading to a buffer overflow [1]. The affected component is the video-core HTTP server, which handles credential processing.

Exploitation

An attacker with network access to the hub and valid low-privilege credentials can send a crafted HTTP request containing an arbitrarily long "region" value in the JSON payload. No user interaction is required. The overflow occurs during the parsing of the credentials handler, overwriting adjacent stack memory [1].

Impact

Successful exploitation allows the attacker to overwrite stack memory, potentially leading to arbitrary code execution in the context of the video-core process. Given the CVSS scope change (S:C), the attacker may affect resources beyond the vulnerable component, possibly gaining full control of the hub [1].

Mitigation

As of the advisory publication date (August 2018), Samsung had not released a firmware update to address this vulnerability. No workaround is available. Users should monitor for official updates from Samsung. The device may be end-of-life, but this is not confirmed in the reference [1].