Approved changes feed: RSS · Atom
cpe:2.3:a:samsung:samsung:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Samsung (0eb241f7-997b-5d1c-b2a3-00a89e1049d3) |
|---|---|
| Product | Samsung (ecc45776-88cb-58f4-8267-4549eae7d1c1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-3927 |
vulnerable | 2026-06-08 05:11:41.425889 |
Details available
MEDIUM (6.8)
An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.
Published: 2018-08-27T15:00:00.000Z
Updated: 2024-09-16T18:03:25.721Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3918 |
vulnerable | 2026-06-08 05:11:41.413679 |
Details available
MEDIUM (6.5)
An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync' operation, leading to arbitrary deletion of cameras. An attacker can send an HTTP request to trigger this vulnerability.
Published: 2018-08-27T15:00:00.000Z
Updated: 2024-09-17T03:13:23.241Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3916 |
vulnerable | 2026-06-08 05:11:41.412999 |
Details available
HIGH (7.5)
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can send an arbitrarily long 'directory' value in order to exploit this vulnerability. An attacker can send an HTTP request to trigger this vulnerability.
Published: 2018-08-28T20:00:00.000Z
Updated: 2024-09-16T18:44:01.461Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3911 |
vulnerable | 2026-06-08 05:11:41.411184 |
Details available
HIGH (8.6)
An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.
Published: 2018-08-23T22:00:00.000Z
Updated: 2024-09-16T18:43:38.067Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3908 |
vulnerable | 2026-06-08 05:11:41.409931 |
Details available
CRITICAL (9.1)
An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly handles pipelined HTTP requests, which allows successive requests to overwrite the previously parsed HTTP method, URL and body. With the implementation of the on_body callback, defined by sub_41734, an attacker can send an HTTP request to trigger this vulnerability.
Published: 2018-08-28T19:00:00.000Z
Updated: 2024-09-17T01:26:10.323Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3904 |
vulnerable | 2026-06-08 05:11:41.408357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3895 |
vulnerable | 2026-06-08 05:11:41.399590 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3880 |
vulnerable | 2026-06-08 05:11:41.381326 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3872 |
vulnerable | 2026-06-08 05:11:41.378471 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3866 |
vulnerable | 2026-06-08 05:11:41.374088 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3856 |
vulnerable | 2026-06-08 05:11:41.363036 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.