Summaryinfo

A vulnerability has been found in Samsung SmartThings Hub STH-ETH-250 0.20.17 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component hubCore. The manipulation leads to certificate validation. This vulnerability is known as CVE-2018-3927. The attack can be launched remotely. There is no exploit available. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Samsung SmartThings Hub STH-ETH-250 0.20.17 (Router Operating System). Affected is an unknown part of the component hubCore. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality. CVE summarizes:

An exploitable information disclosure vulnerability exists in the crash handler of the hubCore binary of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. When hubCore crashes, Google Breakpad is used to record minidumps, which are sent over an insecure HTTPS connection to the backtrace.io service, leading to the exposure of sensitive data. An attacker can impersonate the remote backtrace.io server in order to trigger this vulnerability.

The bug was discovered 07/26/2018. The weakness was shared 08/27/2018 (Website). The advisory is available at talosintelligence.com. This vulnerability is traded as CVE-2018-3927 since 01/01/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 32 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-123292, VDB-123291 and VDB-123293 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Samsung

Name

• SmartThings Hub STH-ETH-250

Version

• 0.20.17

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion