CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26321 – The international version of Xiaomi File Manager has a path traversal vulnerability
https://notcve.org/view.php?id=CVE-2023-26321
28 Aug 2024 — A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file. • https://trust.mi.com/misrc/bulletins/advisory?cveId=541 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26324 – GetApps application has code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-26324
28 Aug 2024 — A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code. • https://https://trust.mi.com/misrc/bulletins/advisory?cveId=544 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37663
https://notcve.org/view.php?id=CVE-2024-37663
17 Jun 2024 — Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remote server by sending out forged ICMP redirect messages. El enrutador Redmi RB03 v1.0.57 es vulnerable a ataques de mensajes de redireccionamiento ICMP falsificados. Un atacante en la misma WLAN que la víctima puede secuestrar el tráfico entre la víctima y cualquier servidor remoto enviando mensajes de redireccionamiento ICMP falsifi... • https://github.com/ouuan/router-vuln-report/blob/master/icmp-redirect/redmi-rb03-redirect.md • CWE-940: Improper Verification of Source of a Communication Channel •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37664
https://notcve.org/view.php?id=CVE-2024-37664
17 Jun 2024 — Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router. El enrutador Redmi RB03 v1.0.57 es vulnerable a TCP DoS o ataques de secuestro. Un atacante en la misma WLAN que la víctima puede desconectar o secuestrar el tráfico entre la víctima y cualquier servidor remoto enviando mensajes TCP RST falsi... • https://github.com/ouuan/router-vuln-report/blob/master/nat-rst/redmi-rb03-nat-rst.md • CWE-940: Improper Verification of Source of a Communication Channel •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26322 – GetApps application has code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-26322
01 May 2024 — A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi... • https://trust.mi.com/misrc/bulletins/advisory?cveId=542 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 0CVE-2023-26320 – Xiaomi Router external request interface vulnerability leads to stack overflow
https://notcve.org/view.php?id=CVE-2023-26320
11 Oct 2023 — Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. La neutralización inadecuada de los elementos especiales utilizados en una vulnerabilidad de comando ("Inyección de comando") en Xiaomi Router permite la inyección de comando. • https://trust.mi.com/misrc/bulletins/advisory?cveId=540 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.3EPSS: 1%CPEs: 2EXPL: 0CVE-2023-26319 – Xiaomi Router administration interface vulnerability leads command injection and stack overflow
https://notcve.org/view.php?id=CVE-2023-26319
11 Oct 2023 — Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. La neutralización inadecuada de los elementos especiales utilizados en una vulnerabilidad de comando ("Inyección de comando") en Xiaomi Router permite la inyección de comando. • https://trust.mi.com/misrc/bulletins/advisory?cveId=536 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-26318 – Xiaomi router web interface post-authorization stack overflow
https://notcve.org/view.php?id=CVE-2023-26318
11 Oct 2023 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers. La vulnerabilidad de copia del búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') de Xiaomi en Xiaomi Router permite desbordar búferes. • https://trust.mi.com/misrc/bulletins/advisory?cveId=539 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26316
https://notcve.org/view.php?id=CVE-2023-26316
02 Aug 2023 — A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies. • https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=322 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26317 – Xiaomi router external request interface has command injection
https://notcve.org/view.php?id=CVE-2023-26317
02 Aug 2023 — A vulnerability has been discovered in Xiaomi routers that could allow command injection through an external interface. This vulnerability arises from inadequate filtering of responses returned from the external interface. Attackers could exploit this vulnerability by hijacking the ISP or an upper-layer router to gain privileges on the Xiaomi router. Successful exploitation of this flaw could permit remote code execution and complete compromise of the device. Xiaomi routers have an external interface that c... • https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=529 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •