CVE-2018-3920

Name of the Vulnerable Software and Affected Versions Yi Home Camera version 1.8.7.0D

Description An exploitable code execution issue exists in the firmware update functionality. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SD card to trigger this issue.

Recommendations For Yi Home Camera version 1.8.7.0D, consider disabling the firmware update functionality via SD card until a patch is available. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.