Lucene search

TalosCVE-2018-3935

HistoryNov 02, 2018 - 5:29 p.m.

CVE-2018-3935

2018-11-0217:29:00

CWE-400

talos

web.nvd.nist.gov

cve-2018-3935

exploit

code execution

vulnerability

udp

yi home camera

denial of service

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

47.6%

JSON

An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can allocate unlimited memory, resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability.

Affected configurations

Nvd

Vulners

Node

yitechnologyyi_home_camera_firmwareMatch1.8.7.0d

AND

yitechnologyyi_home_cameraMatch-

Node

yitechnologyyi_homeMatch-

VendorProductVersionCPE
yitechnologyyi_home_camera_firmware1.8.7.0dcpe:2.3:o:yitechnology:yi_home_camera_firmware:1.8.7.0d:*:*:*:*:*:*:*
yitechnologyyi_home_camera-cpe:2.3:h:yitechnology:yi_home_camera:-:*:*:*:*:*:*:*
yitechnologyyi_home-cpe:2.3:a:yitechnology:yi_home:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yitechnology	yi_home_camera_firmware	1.8.7.0d	cpe:2.3:o:yitechnology:yi_home_camera_firmware:1.8.7.0d:::::::*
yitechnology	yi_home_camera	-	cpe:2.3:h:yitechnology:yi_home_camera:-:::::::*
yitechnology	yi_home	-	cpe:2.3:a:yitechnology:yi_home:-:::::::*

CNA Affected

[
  {
    "product": "Yi Technology",
    "vendor": "unknown",
    "versions": [
      {
        "status": "affected",
        "version": "Yi Technology Home Camera 27US 1.8.7.0D"
      }
    ]
  }
]

References

www.talosintelligence.com/vulnerability_reports/TALOS-2018-0602

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

47.6%

JSON

Related for CVE-2018-3935