CVE-2018-3934

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger this vulnerability.

Score

CVSS 3.1 9.8 Critical

Status

Modified - talos-cna@cisco.com

Published

2018-11-02

Last modified

2024-08-05

Affected products

• Yi Technology (Unknown)
• Yi Home Camera Firmware (Yitechnology)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0601