CVE-2018-3891
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi...
CVE-2018-3891 is a medium vulnerability (CVSS 5.7) in Unknown Yi Technology, published November 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
- Record
CVE-2018-3891- CVSS 3.0
- 5.7 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
EUVDEUVD-2018-15677
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
- Record
EUVD-2018-15677- CVSS 3.0
- 5.7 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vx9-h65m-6rg8
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi...
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
- Record
GHSA-2vx9-h65m-6rg8- CVSS 3.0
- 4.6 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
- Record
CVE-2018-3891- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.7 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |