CVE-2018-3934
9.8
CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger this vulnerability.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.63% — more likely to be exploited than 85% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-11-02 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| yitechnology | yi home camera |
| yitechnology | yi home camera firmware |
References
→ the Explorer · watch your stack · NVD