CVE-2018-3899
Severity CVSS v4.0:
Pending analysis
Type:
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
02/11/2018
Last modified:
02/02/2023
Description
An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. The trans_info call can overwrite a buffer of size 0x104, which is more than enough to overflow the return address from the password_dst field
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Base Score 2.0
5.10
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:yitechnology:yi_home_camera_firmware:1.8.7.0d:*:*:*:*:*:*:* | ||
cpe:2.3:h:yitechnology:yi_home_camera:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page