cve.bz

CVE-2018-3911

8.6 highEPSS 1.2%

High (8.6) in samsung sth-eth-250 firmware. EPSS 1.2% chance of exploitation in the next 30 days.

An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages, leading to partially controlled requests generated toward the internal video-core process. An attacker can send an HTTP request to trigger this vulnerability.

Severity

CVSS 3.1

8.6 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS
1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE
CWE-113
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON