Multiple vulnerabilities in Samsung SmartThings Hub

Recently, the Talos team announced some vulnerabilities related to Samsung SmartThings Hub, including high-risk vulnerabilities such as command injection and remote code execution, with a maximum CVSS score of 9.9.

Samsung SmartThings Hub

Vulnerability Overview

Vulnerability name/categoryCVECVSS score
Video-core Camera Update Code Execution VulnerabilityCVE-2018-3903CVE-2018-39049.9
Video-core voucher code execution vulnerabilityCVE-2018-3873CVE-2018-38789.9
Video-core credential videoHostUrl code execution vulnerabilityCVE-2018-38729.9
Video-core samsungWifiScan code execution vulnerabilityCVE-2018-3863CVE-2018-38669.9
HubCore 39500 Port Synchronous Denial of Service VulnerabilityCVE-2018-39186.5
Video-core camera code execution vulnerabilityCVE-2018-39058.5
Video-core samsungWifiScan code execution vulnerabilityCVE-2018-38679.9
Video-core Database Code Execution VulnerabilityCVE-2018-39197.5
Video-core Database Query Code Execution VulnerabilityCVE-2018-38808.2
Hubcore 39500 Port Header Injection VulnerabilityCVE-2018-39118.6
Video-core AWSELB Cookie Code Line VulnerabilityCVE-2018-39258.5
Video-core REST HTTP Parsing Request Injection VulnerabilityCVE-2018-3907CVE-2018-39099.1
Video-core database shard.videoHostURL code execution vulnerabilityCVE-2018-39067.5
hubCore ZigBee Firmware Upgrade CRC16 Verify Denial of Service VulnerabilityCVE-2018-39265.3
Video-core Database Code Execution VulnerabilityCVE-2018-3912CVE-2018-39177.5
Video-core clips code execution vulnerabilityCVE-2018-3893CVE-2018-38979.9
HubCore Google Breakpad Information Disclosure VulnerabilityCVE-2018-39276.8
Video-core credential parsing SQL injection vulnerabilityCVE-2018-38798.8
Video-core RTSP Configuration Command Injection VulnerabilityCVE-2018-38569.9
Video-core Camera URL Replacement Code Execution VulnerabilityCVE-2018-39029.9

Affected version

  • Samsung SmartThings Hub STH-ETH-250 Firmware Version 20.17


Samsung SmartThings has released a new version of the firmware to fix the high vulnerability, and affected users should update it for protection.