#VU15692 OS command injection in Yi Home Camera - CVE-2018-3910
Published: November 2, 2018
Vulnerability identifier: #VU15692
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-3910
CWE-ID: CWE-78
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerable software:
Yi Home Camera
Yi Home Camera
Software vendor:
YI Technology
YI Technology
Description
The vulnerability allows an adjacent attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to a flaw in in the cloud OTA setup functionality during insufficient sanitization of user-supplied data. An adjacent attacker can trick the victim into connecting their camera to this SSID to inject arbitrary OS commands and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Update to the latest version.