Xiaomi vulnerabilities
We track 14 vulnerabilities in Xiaomi products across 11 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2025.
Latest Xiaomi vulnerabilities
- 9.6 Critical severity
Xiaomi Mi Connect Service: Improper Authentication
An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.
- 7.3 High severity
Xiaomi phone framework has unauthorized access…: Missing Authentication for Critical Functionality
A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
- 8.8 High severity
Xiaomi smarthome application: Origin Validation Error
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- 7.8 High severity
Game center application: Improper Validation of Specified Quantity in Input
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- 8.8 High severity
Xiaomi Router AX9000: Improper Neutralization of Special Elements used in a Command
Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.
- 9.8 Critical severity
GetApps application: Improper Control of Generation of Code
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- 9.8 Critical severity
App Market: Improper Neutralization of Directives in Dynamically Evaluated Code
A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.
- 9.8 Critical severity
GetApps application: Improper Control of Generation of Code
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- 9.8 Critical severity
Xiaomi File Manager App International Version: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.
- 8.8 High severity
GetApps application: Improper Authentication
The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join th
- 8.8 High severity
Router AX9000: Improper Neutralization of Special Elements used in a Command
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
- 9.6 Critical severity
Pro 13: Improper Neutralization of Input During Web Page Generation
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to ex
- 9.6 Critical severity
Pro 13: Improper Neutralization of Input During Web Page Generation
Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit
- 9.8 Critical severity
Xiaomi router: Improper Neutralization of Special Elements used in a Command
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or uppe