CVE-2018-3856 Command injection in Samsung

Critical 9.9 Published 23 Aug 2018 Updated 16 Sep 2024

Attackers can execute arbitrary OS commands on Samsung SmartThings Hubs by exploiting improper handling of spaces in RTSP configuration URLs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-3856?

CVE-2018-3856 is a critical command injection vulnerability in Samsung, published on 23 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field, leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.

Weakness: CWE-88

Which versions are affected by CVE-2018-3856?

It affects 1 product.

Products include Samsung Sth-Eth-250 Firmware.

How do I fix CVE-2018-3856?

No fix has been published for CVE-2018-3856 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-3856 being exploited?

There is no known exploitation of CVE-2018-3856 in the wild and no public exploit code.

Sources

Also known as GHSA-3v82-5w89-j5ww.