CVE-2018-3856: samsung Argument Injection

Vulnerability summary

CVE-2018-3856 is a critical (CVSS 9.9) Argument Injection vulnerability in samsung. EPSS estimates a 3.44% chance of exploitation in the next 30 days, higher than 88.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-08-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.