{"resultsPerPage":29,"startIndex":0,"totalResults":29,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-05T02:07:12.494","vulnerabilities":[{"cve":{"id":"CVE-2018-10751","sourceIdentifier":"cve@mitre.org","published":"2018-05-29T20:29:02.470","lastModified":"2026-06-17T01:34:37.390","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string. The Samsung ID is SVE-2018-11463."},{"lang":"es","value":"Un mensaje push OMACP WAP mal formado puede provocar una corrupción de memoria en un dispositivo Samsung S7 Edge al procesar la porción String Extension de la carga útil WbXml. Esto se debe a un desbordamiento de enteros en la asignación de memoria para esta cadena. El ID de Samsung es SVE-2018-11463."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:N/A:C","baseScore":5.4,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:samsung_mobile:6.0:*:*:*:*:*:*:*","matchCriteriaId":"ABD6EA64-6B65-4487-914F-9EF9CBB78211"},{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:samsung_mobile:7.0:*:*:*:*:*:*:*","matchCriteriaId":"08E4422C-42D0-47CA-A8B7-0DFF0652363E"},{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:samsung_mobile:7.1:*:*:*:*:*:*:*","matchCriteriaId":"088A46CD-DA84-4DFA-ABCB-95E6D82DCE15"},{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:samsung_mobile:7.1.1:*:*:*:*:*:*:*","matchCriteriaId":"2F08AFFF-8310-4CCE-97A1-872CAA97E26D"},{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:samsung_mobile:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"CC76BE55-8569-4C11-BDF7-DB9AD2783313"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security.samsungmobile.com/securityUpdate.smsb","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44724/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://security.samsungmobile.com/securityUpdate.smsb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44724/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2018-3863","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:00.647","lastModified":"2026-06-17T01:57:55.377","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long \"user\" value in order to exploit this vulnerability."},{"lang":"es","value":"En Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17, el proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP para provocar esta vulnerabilidad. Un strcpy desborda el búfer de destino, el cual tiene un tamaño de 40 bytes. Un atacante puede enviar un valor \"user\" arbitrariamente largo para explotar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0548","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0548","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3878","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:00.867","lastModified":"2026-06-17T01:57:56.887","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Multiple exploitable buffer overflow vulnerabilities exist in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. A strncpy overflows the destination buffer, which has a size of 16 bytes. An attacker can send an arbitrarily long \"region\" value in order to exploit this vulnerability."},{"lang":"es","value":"Existen múltiples desbordamientos de búfer explotables en el manipulador de credenciales del servidor HTTP de video-core de los dispositivos Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un strncpy desborda el búfer de destino, el cual tiene un tamaño de 16 bytes. Un atacante puede enviar un valor \"region\" arbitrariamente largo para explotar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0555","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0555","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3879","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:00.990","lastModified":"2026-06-17T01:57:56.993","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in turn leads to a SQL injection in the video-core database. An attacker can send a series of HTTP requests to trigger this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad de inyección JSON explotable en el manipulador de credenciales del servidor HTTP de video-core de los dispositivos Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core analiza incorrectamente la carga útil JSON controlada por el usuario, conduciendo a una inyección SQL que a su vez conduce a una inyección SQL en la base de datos de video-core. Un atacante puede enviar una serie de peticiones HTTP para provocar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0556","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0556","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3902","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:01.100","lastModified":"2026-06-17T01:57:59.350","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the camera \"replace\" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability."},{"lang":"es","value":"Existen un desbordamiento de búfer explotable en la característica de cámara \"replace\" del servidor HTTP de video-core de los dispositivos Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core extrae incorrectamente el campo URL de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP para provocar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0573","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0573","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3903","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:01.210","lastModified":"2026-06-17T01:57:59.457","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The memcpy call overflows the destination buffer, which has a size of 512 bytes. An attacker can send an arbitrarily long \"url\" value in order to overwrite the saved-PC with 0x42424242."},{"lang":"es","value":"En Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17, el proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP para provocar esta vulnerabilidad. La llamada memcpy desborda el búfer de destino, el cual tiene un tamaño de 512 bytes. Un atacante puede enviar un valor \"url\" arbitrariamente largo para sobrescribir saved-PC con 0x42424242."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Talos","product":"Samsung","versions":[{"version":"Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0574","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0574","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3905","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T15:29:01.333","lastModified":"2026-06-17T01:57:59.673","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the camera \"create\" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the \"state\" field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability."},{"lang":"es","value":"Existen un desbordamiento de búfer explotable en la característica de cámara \"create\" del servidor HTTP de video-core de los dispositivos Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core extrae incorrectamente el campo \"state\" de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP para provocar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0575","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0575","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3866","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T22:29:00.370","lastModified":"2026-06-17T01:57:55.697","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the samsungWifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strcpy at [8] overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long 'callbackUrl' value in order to exploit this vulnerability."},{"lang":"es","value":"Existe un desbordamiento de búfer explotable en el manipulador samsungWifiScan del servidor HTTP de video-core de Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. El strcpy de [8] desborda el búfer de destino, el cual tiene un tamaño de 40 bytes. Un atacante puede enviar un valor \"callbackUrl\" arbitrariamente largo para explotar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"Samsung","versions":[{"version":"Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0548","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3872","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-23T22:29:00.477","lastModified":"2026-06-17T01:57:56.243","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts the videoHostUrl field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability."},{"lang":"es","value":"Existe un desbordamiento de búfer explotable en el manipulador de credenciales del servidor HTTP de video-core de Samsung SmartThings Hub STH-ETH-250 en su versión de firmware 0.20.17. El proceso video-core extrae incorrectamente el campo videoHostUrl de una carga útil JSON controlada por el usuario, conduciendo a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP para provocar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"Samsung","versions":[{"version":"Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0554","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0554","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3893","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-27T15:29:00.917","lastModified":"2026-06-17T01:57:58.487","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad explotable de desbordamiento de búfer en el manipulador /cameras/XXXX/clips del servidor HTTP de video-core de Samsung SmartThings Hub STH-ETH-250 con firmware en versión 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil o payload JSON controlada por el usuario, lo que conduce a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP manipulada para desencadenar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3904","sourceIdentifier":"talos-cna@cisco.com","published":"2018-08-27T15:29:01.027","lastModified":"2026-06-17T01:57:59.567","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the camera 'update' feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad explotable de desbordamiento de búfer en la característica \"update\" del servidor HTTP de video-core de Samsung SmartThings Hub STH-ETH-250 con firmware en versión 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, lo que conduce a un desbordamiento de búfer en la pila. Un atacante puede enviar una petición HTTP manipulada para desencadenar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"Samsung","versions":[{"version":"Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0574","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0574","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3896","sourceIdentifier":"talos-cna@cisco.com","published":"2018-09-10T15:29:04.467","lastModified":"2026-06-17T01:57:58.807","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long \"correlationId\" value in order to exploit this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad explotable de desbordamiento de búfer en el manipulador /cameras/XXXX/clips del servidor HTTP de video-core de Samsung SmartThings Hub con firmware en versión 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, lo que conduce a un desbordamiento de búfer en la pila. La llamada strncpy desborda el búfer de destino, que tiene un tamaño de 52 bytes. Un atacante puede enviar un valor \"correlationId\" arbitrariamente largo para explotar esta vulnerabilidad"}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3897","sourceIdentifier":"talos-cna@cisco.com","published":"2018-09-10T15:29:04.653","lastModified":"2026-06-17T01:57:58.920","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long \"callbackUrl\" value in order to exploit this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad explotable de desbordamiento de búfer en el manipulador /cameras/XXXX/clips del servidor HTTP de video-core de Samsung SmartThings Hub con firmware en versión 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, lo que conduce a un desbordamiento de búfer en la pila. La llamada strncpy desborda el búfer de destino, que tiene un tamaño de 52 bytes. Un atacante puede enviar un valor \"callbackUrl\" arbitrariamente largo para explotar esta vulnerabilidad"}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-3875","sourceIdentifier":"talos-cna@cisco.com","published":"2018-09-10T19:29:00.500","lastModified":"2026-06-17T01:57:56.560","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy overflows the destination buffer, which has a size of 2,000 bytes. An attacker can send an arbitrarily long \"sessionToken\" value in order to exploit this vulnerability."},{"lang":"es","value":"Existe una vulnerabilidad explotable de desbordamiento de búfer en el manipulador de credenciales del servidor HTTP de video-core de Samsung SmartThings Hub STH-ETH-250 con firmware en versión 0.20.17. El proceso video-core extrae incorrectamente campos de una carga útil JSON controlada por el usuario, lo que conduce a un desbordamiento de búfer en la pila. La llamada strncpy desborda el búfer de destino, que tiene un tamaño de 2.000 bytes. Un atacante puede enviar un valor \"sessionToken\" arbitrariamente largo para explotar esta vulnerabilidad."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"Samsung","product":"SmartThings Hub STH-ETH-250","versions":[{"version":"Firmware version 0.20.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:sth-eth-250_firmware:0.20.17:*:*:*:*:*:*:*","matchCriteriaId":"69ED63CA-72C3-4337-B1ED-1696DB316B0F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:sth-eth-250:-:*:*:*:*:*:*:*","matchCriteriaId":"4B42493E-7140-4A19-B94A-2F6262D0BCDA"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0555","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-25331","sourceIdentifier":"mobile.security@samsung.com","published":"2021-03-04T21:15:13.057","lastModified":"2026-06-17T03:41:50.860","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen in specific condition."},{"lang":"es","value":"Un control de acceso inapropiado en la aplicación Samsung Pay mini versión anterior a v4.0.14, permite el acceso no autorizado a la información del saldo en la pantalla de bloqueo en condiciones específicas"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay Mini","versions":[{"version":"unspecified","lessThan":"4.0.14","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":3.2,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.7,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:N/A:N","baseScore":1.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:pay_mini:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.14","matchCriteriaId":"8682C73B-FDE2-44DD-9DD4-AC1F3A4AEF5F"}]}]}],"references":[{"url":"https://security.samsungmobile.com","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-25332","sourceIdentifier":"mobile.security@samsung.com","published":"2021-03-04T21:15:13.260","lastModified":"2026-06-17T03:41:52.527","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to contacts information over the lockscreen in specific condition."},{"lang":"es","value":"Un control de acceso inapropiado en la aplicación Samsung Pay mini anterior a la v4.0.14 permite el acceso no autorizado a la información de los contactos por medio de la pantalla de bloqueo en condiciones específicas"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay Mini","versions":[{"version":"unspecified","lessThan":"4.0.14","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":3.2,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.7,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:N/A:N","baseScore":1.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:pay_mini:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.14","matchCriteriaId":"8682C73B-FDE2-44DD-9DD4-AC1F3A4AEF5F"}]}]}],"references":[{"url":"https://security.samsungmobile.com","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-25333","sourceIdentifier":"mobile.security@samsung.com","published":"2021-03-04T21:15:13.337","lastModified":"2026-06-17T03:41:53.293","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Samsung Pay mini application prior to v4.0.14 allows unauthorized access to balance information over the lockscreen via scanning specific QR code."},{"lang":"es","value":"Un control de acceso inapropiado en la aplicación Samsung Pay mini anterior a la v4.0.14 permite el acceso no autorizado a la información del saldo en la pantalla de bloqueo mediante el escaneo de un código QR específico"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay Mini","versions":[{"version":"unspecified","lessThan":"4.0.14","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":3.2,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.7,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:N/A:N","baseScore":1.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:pay_mini:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.14","matchCriteriaId":"8682C73B-FDE2-44DD-9DD4-AC1F3A4AEF5F"}]}]}],"references":[{"url":"https://security.samsungmobile.com","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-25525","sourceIdentifier":"mobile.security@samsung.com","published":"2021-12-08T15:15:08.827","lastModified":"2026-06-17T03:42:14.653","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper check or handling of exception conditions vulnerability in Samsung Pay (US only) prior to version 4.0.65 allows attacker to use NFC without user recognition."},{"lang":"es","value":"Una vulnerabilidad de comprobación o administración inapropiada de las condiciones de excepción en Samsung Pay (US only) versiones anteriores a 4.0.65, permite al atacante usar NFC sin el reconocimiento del usuario"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","versions":[{"version":"-","lessThan":"4.0.65","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:L","baseScore":2.0,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.4,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:N/I:P/A:N","baseScore":3.3,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.5,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-703"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-754"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:pay:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.65","matchCriteriaId":"AEF979F8-567C-49FD-9BDF-1C6714EC6619"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2021-25527","sourceIdentifier":"mobile.security@samsung.com","published":"2021-12-08T15:15:08.963","lastModified":"2026-06-17T03:42:14.880","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication."},{"lang":"es","value":"Se presenta una vulnerabilidad de exportación inapropiada de componentes de aplicaciones Android en Samsung Pay (sólo en la India) versiones anteriores a 4.1.77, que permite a un atacante acceder al menú Bill Pay y Recharge sin autenticación"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","versions":[{"version":"-","lessThan":"4.1.77","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-926"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:pay:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.77","matchCriteriaId":"BCEFD590-985D-4B75-B61B-416D46219E14"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-36870","sourceIdentifier":"mobile.security@samsung.com","published":"2022-09-09T15:15:12.747","lastModified":"2026-06-17T04:54:05.287","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent."},{"lang":"es","value":"Una vulnerabilidad de secuestro de intención pendiente en MTransferNotificationManager en Samsung Pay versiones anteriores a 5.0.63 para KR y 5.1.47 para Global, permite a atacantes acceder a archivos sin permiso por medio de una intención implícita"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","versions":[{"version":"unspecified","lessThan":"5.0.63 for KR and 5.1.47 for Global","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":4.0}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay:*:*:*:*:*:android:*:*","versionEndExcluding":"5.1.47","matchCriteriaId":"656DC662-4AD9-4B86-97ED-97941C9A8193"},{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay_kr:*:*:*:*:*:android:*:*","versionEndExcluding":"5.0.63","matchCriteriaId":"E7775496-FCF2-486C-A37D-02B1E1549A71"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-36871","sourceIdentifier":"mobile.security@samsung.com","published":"2022-09-09T15:15:12.810","lastModified":"2026-06-17T04:54:05.390","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent."},{"lang":"es","value":"Una vulnerabilidad de secuestro de intención pendiente en NotiCenterUtils en Samsung Pay versiones anteriores a 5.0.63 para KR y 5.1.47 para Global, permite a atacantes acceder a archivos sin permiso por medio de una intención implícita"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","versions":[{"version":"unspecified","lessThan":"5.0.63 for KR and 5.1.47 for Global","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":4.0}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay:*:*:*:*:*:android:*:*","versionEndExcluding":"5.1.47","matchCriteriaId":"656DC662-4AD9-4B86-97ED-97941C9A8193"},{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay_kr:*:*:*:*:*:android:*:*","versionEndExcluding":"5.0.63","matchCriteriaId":"E7775496-FCF2-486C-A37D-02B1E1549A71"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-36872","sourceIdentifier":"mobile.security@samsung.com","published":"2022-09-09T15:15:12.880","lastModified":"2026-06-17T04:54:05.493","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent."},{"lang":"es","value":"Una vulnerabilidad de secuestro de intención pendiente en SpayNotification en Samsung Pay versiones anteriores a 5.0.63 para KR y 5.1.47 para Global, permite a atacantes acceder a archivos sin permiso por medio de una intención implícita"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","versions":[{"version":"unspecified","lessThan":"5.0.63 for KR and 5.1.47 for Global","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":4.0}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay:*:*:*:*:*:android:*:*","versionEndExcluding":"5.1.47","matchCriteriaId":"656DC662-4AD9-4B86-97ED-97941C9A8193"},{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay_kr:*:*:*:*:*:android:*:*","versionEndExcluding":"5.0.63","matchCriteriaId":"E7775496-FCF2-486C-A37D-02B1E1549A71"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2022-36876","sourceIdentifier":"mobile.security@samsung.com","published":"2022-09-09T15:15:13.133","lastModified":"2026-06-17T04:54:05.923","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication."},{"lang":"es","value":"Una autorización inapropiada en UPI payment in Samsung Pass versiones anteriores a 4.0.04.10, permite a atacantes físicos acceder a la lista de cuentas sin autenticación"}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pass","versions":[{"version":"unspecified","lessThan":"4.0.04.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":1.8,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.3,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}]},"weaknesses":[{"source":"mobile.security@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pass:*:*:*:*:*:android:*:*","versionEndExcluding":"4.0.04.10","matchCriteriaId":"750FCFD3-C5DE-44B8-BD87-F2CE450C3C0D"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-20850","sourceIdentifier":"mobile.security@samsung.com","published":"2024-04-02T03:15:10.017","lastModified":"2026-06-17T07:08:01.187","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of Samsung Pay."},{"lang":"es","value":"El uso de intención implícita para comunicación confidencial en Samsung Pay anterior a la versión 5.4.99 permite a atacantes locales acceder a información de Samsung Pay."}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Samsung Pay","defaultStatus":"affected","versions":[{"version":"5.4.99","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-04-03T14:55:25.621040Z","id":"CVE-2024-20850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:samsung_pay:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.99","matchCriteriaId":"60E652F2-829B-4E4B-B8DC-2B66F930C8DB"}]}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04","source":"mobile.security@samsung.com","tags":["Vendor Advisory"]},{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=04","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-22377","sourceIdentifier":"cve@mitre.org","published":"2025-05-27T17:15:25.463","lastModified":"2026-06-17T08:46:54.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload."},{"lang":"es","value":"Se descubrió un problema en Samsung Mobile Processor, Wearable Processor, y Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, módem 5123, módem 5300, módem 5400. Existe una escritura fuera de los límites basada en montón en la implementación del protocolo GPRS debido a una discrepancia entre la longitud real del payload y la longitud declarada dentro del payload."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-05-27T18:43:32.178927Z","id":"CVE-2025-22377","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_1080_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43DE4D6F-D662-46F2-93BC-9AE950320BDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_1080:-:*:*:*:*:*:*:*","matchCriteriaId":"EE06CD56-8BFD-4208-843A-179E3E6F5C10"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_1280_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BD1A7B09-9031-4E54-A24F-3237C054166B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_1280:-:*:*:*:*:*:*:*","matchCriteriaId":"DFC68046-2F08-40D1-B158-89D8D9263541"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_1330_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C2635646-DD6A-4735-8E01-F45445584832"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_1330:-:*:*:*:*:*:*:*","matchCriteriaId":"AA0F8A58-71B7-4503-A03A-6FB4282D75BD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_1380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D381478B-C638-4663-BD71-144BE4B02E46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_1380:-:*:*:*:*:*:*:*","matchCriteriaId":"61E72146-72FE-4B54-AB79-3C665E7F016C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_1480_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"64897B0D-EBF6-4BEB-BF54-ABCDBFAB45E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_1480:-:*:*:*:*:*:*:*","matchCriteriaId":"F3F328B4-0442-4748-B5EE-DD1CEE50D6CF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_2100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"89B88BFE-3C82-498C-8EC1-5784836DB1A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_2100:-:*:*:*:*:*:*:*","matchCriteriaId":"9385885D-654A-496E-8029-7C6D9B077193"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_2200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63C0D9AC-BD23-48C9-83E7-301DEC06E583"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_2200:-:*:*:*:*:*:*:*","matchCriteriaId":"A72ADEBB-ED72-4A5B-BB27-95EDE43F8116"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_2400_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16D9272E-1794-48FF-B6A4-8F48395BA38E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_2400:-:*:*:*:*:*:*:*","matchCriteriaId":"932F5FB3-5527-44D7-9DD9-EF03963E3CA3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1928760C-4FC4-45B0-84FF-C1105CD1DD2A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_850:-:*:*:*:*:*:*:*","matchCriteriaId":"BB410A6D-642B-49AE-8B1C-EADA953A84DA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_9110_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F1896BFF-D709-481B-AD4F-37D1A8B30C06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_9110:-:*:*:*:*:*:*:*","matchCriteriaId":"E6748EF2-3C63-41CD-B3D1-4B3FEC614B40"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5F18F62E-2012-442E-BE60-6E76325D1824"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*","matchCriteriaId":"0D8701B6-6989-44D1-873A-A1823BFD7CCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BCF6C91D-DECE-4630-85FE-C22EF2B9160A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_990:-:*:*:*:*:*:*:*","matchCriteriaId":"87FE8214-E165-4874-BB5A-3C4298708039"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_modem_5123_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06B60F97-1320-44F5-970C-BBA29F375524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_modem_5123:-:*:*:*:*:*:*:*","matchCriteriaId":"72419735-076A-4E72-869F-0C7D801371C1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_modem_5300_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F66A096-7BA3-47D6-98F4-879C3A4C1FFC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_modem_5300:-:*:*:*:*:*:*:*","matchCriteriaId":"CE202894-D48A-4B9E-B3BD-28529967A0B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_modem_5400_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE283E70-150F-4A64-AF37-F12856C55637"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_modem_5400:-:*:*:*:*:*:*:*","matchCriteriaId":"8FE405A6-E0E3-47D5-9901-B370A3AAD423"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_w1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"526A0088-BDA7-4373-8966-AEED69C1AE8A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_w1000:-:*:*:*:*:*:*:*","matchCriteriaId":"A9657C28-AA6B-4C1A-ACAA-E90645CF2A73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_w920_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B6ADED27-EDAF-4FB3-8CB2-AE5F59B93641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_w920:-:*:*:*:*:*:*:*","matchCriteriaId":"4BF79654-E5C6-4DFF-B33A-A78571CD300C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:samsung:exynos_w930_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"801E188F-C71B-4933-9099-151A4A1B1BC5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:samsung:exynos_w930:-:*:*:*:*:*:*:*","matchCriteriaId":"8D8FC82D-57C5-4F00-BDF4-4261A32C4246"}]}]}],"references":[{"url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-22377/","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-47309","sourceIdentifier":"PSIRT@samsung.com","published":"2026-05-19T07:16:29.813","lastModified":"2026-07-24T12:10:00.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.\n\nThis issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3."},{"lang":"es","value":"Una vulnerabilidad de recursión incontrolada en Samsung Open Source Escargot permite cargas útiles de datos serializados de tamaño excesivo.\n\nEste problema afecta a Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3."}],"affected":[{"source":"PSIRT@samsung.com","affectedData":[{"vendor":"Samsung Open Source","product":"Escargot","defaultStatus":"unaffected","versions":[{"version":"590345cc6258317c5da850d846ce6baaf2afc2d3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"PSIRT@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-19T12:35:48.306900Z","id":"CVE-2026-47309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"PSIRT@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samsung:escargot:2026-05-14:*:*:*:*:*:*:*","matchCriteriaId":"CF1CF9BD-2F12-4308-A9F3-0C8748CF6BD6"}]}]}],"references":[{"url":"https://github.com/Samsung/escargot/pull/1565","source":"PSIRT@samsung.com","tags":["Issue Tracking","Patch"]}]}},{"cve":{"id":"CVE-2026-47306","sourceIdentifier":"PSIRT@samsung.com","published":"2026-06-04T10:16:38.927","lastModified":"2026-07-22T20:10:00.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945."},{"lang":"es","value":"Vulnerabilidad de recursión incontrolada en rlottie de código abierto de Samsung permite cargas útiles de datos serializados sobredimensionados.\n\nEste problema afecta a rlottie: antes de e2d19e3b150e0e4a9586fa90b56fd3061cc98945."}],"affected":[{"source":"PSIRT@samsung.com","affectedData":[{"vendor":"Samsung Open Source","product":"rlottie","defaultStatus":"affected","versions":[{"version":"e2d19e3b150e0e4a9586fa90b56fd3061cc98945","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"PSIRT@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-04T12:15:14.252517Z","id":"CVE-2026-47306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"PSIRT@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/Samsung/rlottie/pull/585","source":"PSIRT@samsung.com"}]}},{"cve":{"id":"CVE-2026-47320","sourceIdentifier":"PSIRT@samsung.com","published":"2026-06-04T10:16:39.323","lastModified":"2026-07-22T20:10:00.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3."},{"lang":"es","value":"Acceso de puntero no inicializado, vulnerabilidad de recursión no controlada en rlottie de código abierto de Samsung permite manipulación de punteros, cargas útiles de datos serializados de tamaño excesivo.\n\nEste problema afecta a rlottie: antes de eae37633fda13ac05b25c6c95aacea4bc33c80a3."}],"affected":[{"source":"PSIRT@samsung.com","affectedData":[{"vendor":"Samsung Open Source","product":"rlottie","defaultStatus":"affected","versions":[{"version":"eae37633fda13ac05b25c6c95aacea4bc33c80a3","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"PSIRT@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-04T12:19:42.336040Z","id":"CVE-2026-47320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"PSIRT@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-824"}]}],"references":[{"url":"https://github.com/Samsung/rlottie/pull/593","source":"PSIRT@samsung.com"}]}},{"cve":{"id":"CVE-2026-82797","sourceIdentifier":"PSIRT@samsung.com","published":"2026-08-31T12:17:58.350","lastModified":"2026-09-01T20:50:58.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51."}],"affected":[{"source":"PSIRT@samsung.com","affectedData":[{"vendor":"Samsung Open Source","product":"rlottie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8de0d9e6ca80ffef654965505981727b9fa06a51","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"PSIRT@samsung.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-31T14:27:09.436917Z","id":"CVE-2026-82797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"PSIRT@samsung.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/Samsung/rlottie/pull/603","source":"PSIRT@samsung.com"}]}}]}