Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
104 results · page 1 of 3
Aug 10, 2026A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perforCVE-2026-72581 · Other software · duhow · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.6
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.
- Product
- xiaoai-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smartCVE-2026-72580 · Other software · duhow · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.8
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.
- Product
- xiaoai-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuratioCVE-2026-26214 · Computers, phones & browsers · Xiaomi Technology Co., Ltd. · reported by VulnCheckCritical 9.1
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.
- Product
- Galaxy FDS Android SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP.CVE-2024-45347 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comCritical 9.6
An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.
- Product
- Xiaomi Mi Connect Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP.CVE-2024-45361 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.5
A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.
- Product
- Xiaomi Mi Connect Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A unauthorized access vulnerability exists in the Xiaomi phone framework.CVE-2024-45356 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.3
A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
- Product
- Xiaomi phone framework has unauthorized access vulnerability
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A unauthorized access vulnerability exists in the Xiaomi phone framework.CVE-2024-45355 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 5.5
A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
- Product
- Xiaomi phone framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025A code execution vulnerability exists in the Xiaomi shop applicationproduct.CVE-2024-45354 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Xiaomi shop application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025An intent redriction vulnerability exists in the Xiaomi quick App framework application product.CVE-2024-45353 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.
- Product
- quick app framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025An code execution vulnerability exists in the Xiaomi smarthome application product.CVE-2024-45352 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Xiaomi smarthome application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025A code execution vulnerability exists in the Xiaomi Game center application product.CVE-2024-45351 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.8
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Game center application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024Xiaomi Router AX9000 has a post-authorization command injection vulnerability.CVE-2024-45348 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.4
Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.
- Product
- Xiaomi Router AX9000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A code execution vulnerability exists in the XiaomiGetApps application product.CVE-2023-26324 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- Product
- GetApps application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A code execution vulnerability exists in the Xiaomi App market product.CVE-2023-26323 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.6
A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.
- Product
- App Market
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A code execution vulnerability exists in the XiaomiGetApps application product.CVE-2023-26322 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
- Product
- GetApps application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A path traversal vulnerability exists in the Xiaomi File Manager application product(international version).CVE-2023-26321 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.3
A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file.
- Product
- Xiaomi File Manager App International Version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same tiCVE-2024-45346 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
- Product
- GetApps application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024The Xiaomi router AX9000 has a post-authentication command injection vulnerability.CVE-2023-26315 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.5
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
- Product
- Router AX9000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability.CVE-2024-4406 · Computers, phones & browsers · Xiaomi · reported by zdi-disclosures@trendmicro.comCritical 9.6
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the integral-dialog-page.html file. When parsing the integralInfo parameter, the process does not properly sanitize user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22332.
- Product
- Pro 13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability.CVE-2024-4405 · Computers, phones & browsers · Xiaomi · reported by zdi-disclosures@trendmicro.comCritical 9.6
Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the manual-upgrade.html file. When parsing the manualUpgradeInfo parameter, the process does not properly sanitize user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22379.
- Product
- Pro 13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Oct 11, 2023Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.CVE-2023-26320 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7.5
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
- Product
- Xiaomi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Oct 11, 2023Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.CVE-2023-26319 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.7
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
- Product
- Xiaomi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Oct 11, 2023Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.CVE-2023-26318 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 6.7
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.
- Product
- Xiaomi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Aug 2, 2023Xiaomi routers have an external interface that can lead to command injection.CVE-2023-26317 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 7
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing.
- Product
- Xiaomi router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Aug 2, 2023A XSS vulnerability exists in the Xiaomi cloud service Application product.CVE-2023-26316 · Other software · MI · reported by security@xiaomi.comMedium 6.1
A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies.
- Product
- Xiaomi Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Mar 29, 2023When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability.CVE-2020-14140 · Other software · MI · reported by security@xiaomi.comHigh 7.5
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
- Product
- Xiaomi Router Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Oct 11, 2022The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experCVE-2020-14131 · Other software · MI · reported by security@xiaomi.comCritical 9.8
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
- Product
- Xiaomi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Oct 11, 2022A logic vulnerability exists in a Xiaomi product.CVE-2020-14129 · Other software · MI · reported by security@xiaomi.comCritical 9.8
A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.
- Product
- Xiaomi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jul 22, 2022information leakage vulnerability exists in the Xiaomi SmartHome APP.CVE-2020-14114 · Other software · MI · reported by security@xiaomi.comHigh 7.5
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.
- Product
- Smarthome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jul 14, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14127 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jun 16, 2022Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks.CVE-2022-31277 · Other software · MI · reported by MITREHigh 8.8
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.
- Product
- Xiaomi Lamp 1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14125 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verificationCVE-2020-14122 · Other software · MI · reported by security@xiaomi.comMedium 5.5
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022Some Xiaomi models have a vulnerability in a certain application.CVE-2020-14120 · Other software · MI · reported by security@xiaomi.comHigh 8.8
Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022A improper permission configuration vulnerability in Xiaomi Content Center APP.CVE-2020-14117 · Other software · MI · reported by security@xiaomi.comMedium 5.3
A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permission verification in the Xiaomi content center APP, and attackers can use this vulnerability to invoke the sensitive component functions of the Xiaomi content center APP.
- Product
- Content Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Mar 10, 2022A command injection vulnerability exists in the Xiaomi Router AX3600.CVE-2020-14115 · Other software · MI · reported by security@xiaomi.comCritical 9.8
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Mar 10, 2022Information Leak Vulnerability exists in the Xiaomi Router AX6000.CVE-2020-14112 · Other software · MI · reported by security@xiaomi.comMedium 5.3
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000.
- Product
- Ax6000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Mar 10, 2022A command injection vulnerability exists in the Xiaomi Router AX3600.CVE-2020-14111 · Other software · MI · reported by security@xiaomi.comHigh 7.8
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jan 18, 2022A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.CVE-2020-14107 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.
- Product
- Xiaomi Mirror Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Sep 16, 2021There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12.CVE-2020-14124 · Other software · MI · reported by security@xiaomi.comCritical 9.8
There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12.
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Sep 16, 2021There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600CVE-2020-14119 · Other software · MI · reported by security@xiaomi.comCritical 9.8
There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom< 1.1.12
- Product
- Ax3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Sep 16, 2021Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.2108CVE-2020-14130 · Other software · MI · reported by security@xiaomi.comMedium 5.3
Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809
- Product
- Xiaomi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Sep 16, 2021There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 withCVE-2020-14109 · Other software · MI · reported by security@xiaomi.comHigh 7.2
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 20, 2021The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14105 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.CVE-2020-14106 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14103 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.CVE-2020-14104 · Other software · MI · reported by security@xiaomi.comHigh 8.1
A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.
- Product
- Ax3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can CVE-2020-14099 · Other software · MI · reported by security@xiaomi.comHigh 7.5
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.
- Product
- Ax1800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Sep 11, 2020In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution.CVE-2020-14100 · Other software · MI · reported by security@xiaomi.comCritical 9.8
In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router administrator can gain root access from this vulnerability.
- Product
- R3600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Sep 11, 2020Memory overflow in Xiaomi AI speaker Rom version <1.59.6 can happen when the speaker verifying a malicious firmware during OTA process.CVE-2020-14096 · Other software · MI · reported by security@xiaomi.comCritical 9.8
Memory overflow in Xiaomi AI speaker Rom version <1.59.6 can happen when the speaker verifying a malicious firmware during OTA process.
- Product
- Xiaomi AI Speaker Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.