CVE-2018-3938 Memory corruption in Sony
A stack-based buffer overflow in Sony IPELA cameras allows remote code execution via a malicious POST request.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-3938?
CVE-2018-3938 is a critical memory corruption vulnerability in Talos Sony, published on 14 Aug 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST request to trigger this vulnerability.
Weakness: CWE-787
Which versions are affected by CVE-2018-3938?
It affects 14 products.
Products include Sony Snc-Eb600 Firmware, Sony Snc-Eb600b Firmware, Sony Snc-Eb602r Firmware, Sony Snc-Eb630 Firmware, Sony Snc-Eb630b Firmware, Sony Snc-Eb632r Firmware and 8 more.
How do I fix CVE-2018-3938?
No fix has been published for CVE-2018-3938 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-3938 being exploited?
There is no known exploitation of CVE-2018-3938 in the wild and no public exploit code.
Other vulnerabilities in Talos Sony
Sources
Also known as GHSA-7qmf-37fc-vqcp.