Samsung Patches Critical Vulnerabilities in SmartThings Hub

31.7.18 securityweek Vulnerebility

Samsung has patched a series of critical vulnerabilities in its SmartThings Hub, which could be exploited to execute OS commands or other arbitrary code on vulnerable devices.

Designed as a central controller, the SmartThings Hub allows users monitor and manage smart home devices such as smart plugs, LED light bulbs, thermostats, cameras, and more. The controller runs a Linux-based firmware that allows for communications with Internet of Things devices deployed in the home using Ethernet, Zigbee, Z-Wave and Bluetooth.

An attacker able to leverage the discovered vulnerabilities could access sensitive information gathered by the connected devices, monitor and control devices within the home, and perform unauthorized activities. They could also unlock homes, monitor users via cameras inside homes, disable motion detectors, and even cause physical damage to appliances.

A total of 20 vulnerabilities impacting the SmartThings Hub were discovered by Talos researchers, who reveal that an attacker could “chain together three vulnerability classes that are present in the device to gain complete control of the device.” In a blog post, the researchers also describe different attack vectors an actor looking to exploit these vulnerability chains could use.

The vulnerabilities were found in Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. Samsung has already released patches for all flaws and users are advised to update their devices to stay secure (because Samsung pushes the updates automatically and user interaction should not be necessary).