PT-2018-16283 · Yi · Yi Home Camera
CVE-2018-3890
·
Publicado
2018-11-02
·
Atualizado
2023-02-02
CVSS v3.1
7.6
Alta
| Vetor | AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Yi Home Camera 27US version 1.8.7.0D
Description
An exploitable code execution issue exists in the firmware update functionality. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this issue.
Recommendations
For Yi Home Camera 27US version 1.8.7.0D, consider disabling the firmware update functionality via SD card insertion until a patch is available. Restrict access to the camera's firmware update module to minimize the risk of exploitation.
Exploit
Correção
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Yi Home Camera