CVE-2018-3880

CVE-2018-3880 is a critical stack-based buffer overflow vulnerability affecting the Samsung SmartThings Hub STH-ETH-250 (firmware version 0.20.17). Specifically, the video-core process's HTTP server improperly handles existing records in its SQLite database when processing "find-by-cameraId" requests. An authenticated attacker can exploit this by sending a crafted HTTP request. This vulnerability carries a CVSS score of 9.9 (CRITICAL), indicating a high-impact attack that can be executed remotely with low complexity, leading to complete compromise of confidentiality, integrity, and availability. While the Exploit Prediction Scoring System (EPSS) score is low, its FAUCET Risk Score is 93/100. There is no evidence of active exploitation (not in KEV or Hot List), and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers.