CVE-2018-3891

Name of the Vulnerable Software and Affected Versions Yi Home Camera 27US version 1.8.7.0D

Description A firmware downgrade vulnerability exists in the firmware update functionality. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this issue.

Recommendations For Yi Home Camera 27US version 1.8.7.0D, as a temporary workaround, consider disabling the firmware update functionality until a patch is available. Restrict access to the SD card slot to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.