Lucene search

TalosCVE-2018-3898

HistoryNov 02, 2018 - 5:29 p.m.

CVE-2018-3898

2018-11-0217:29:00

CWE-120

talos

web.nvd.nist.gov

cve

2018

3898

code execution

vulnerability

yi home camera

buffer overflow

qr code scanning

nvd

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

62.1%

JSON

An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans_info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the ssid_dst field.

Affected configurations

Nvd

Vulners

Node

yitechnologyyi_home_camera_firmwareMatch1.8.7.0d

AND

yitechnologyyi_home_cameraMatch-

VendorProductVersionCPE
yitechnologyyi_home_camera_firmware1.8.7.0dcpe:2.3:o:yitechnology:yi_home_camera_firmware:1.8.7.0d:*:*:*:*:*:*:*
yitechnologyyi_home_camera-cpe:2.3:h:yitechnology:yi_home_camera:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yitechnology	yi_home_camera_firmware	1.8.7.0d	cpe:2.3:o:yitechnology:yi_home_camera_firmware:1.8.7.0d:::::::*
yitechnology	yi_home_camera	-	cpe:2.3:h:yitechnology:yi_home_camera:-:::::::*

CNA Affected

[
  {
    "product": "Yi Technology",
    "vendor": "unknown",
    "versions": [
      {
        "status": "affected",
        "version": "Yi Technology Home Camera 27US 1.8.7.0D"
      }
    ]
  }
]

References

www.talosintelligence.com/vulnerability_reports/TALOS-2018-0571

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

62.1%

JSON

Related for CVE-2018-3898