Mi vulnerabilities
We track 11 vulnerabilities in Mi products across 8 products. 11 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 23, 2024.
Latest Mi vulnerabilities
- 8.8 High severity
Xiaomi Router AX9000: Improper Neutralization of Special Elements used in a Command
Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.
- 9.8 Critical severity
GetApps application: Improper Control of Generation of Code
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- 9.8 Critical severity
GetApps application: Improper Control of Generation of Code
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- 9.8 Critical severity
Xiaomi File Manager App International Version: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.
- 8.8 High severity
Router AX9000: Improper Neutralization of Special Elements used in a Command
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
- 8.8 High severity
AX1800: Stack-based Buffer Overflow
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required
- 9.6 Critical severity
Pro 13: Improper Neutralization of Input During Web Page Generation
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to ex
- 9.6 Critical severity
Pro 13: Improper Neutralization of Input During Web Page Generation
Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit
- 9.8 Critical severity
Xiaomi router: Improper Neutralization of Special Elements used in a Command
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or uppe
- 8.8 High severity
Xiaomi Lamp 1 Firmware: Authentication Bypass by Capture-replay
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.
- 8.8 High severity
Google Chromium V8 Integer Overflow Exploited
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.