PT-2018-12276 · Xiaomi · Xiaomi R3D+1

Publicado 2018-07-15 · Atualizado 2018-09-12 · CVE-2018-14010

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiaomi R3P versions prior to 2.14.5 Xiaomi R3C versions prior to 2.12.15 Xiaomi R3 versions prior to 2.22.15 Xiaomi R3D versions prior to 2.26.4

Description The issue concerns an OS command injection in the guest Wi-Fi settings feature, specifically in the /cgi-bin/luci endpoint, allowing an attacker to execute any command via crafted JSON data.

Recommendations For Xiaomi R3P versions prior to 2.14.5, update to version 2.14.5 or later. For Xiaomi R3C versions prior to 2.12.15, update to version 2.12.15 or later. For Xiaomi R3 versions prior to 2.22.15, update to version 2.22.15 or later. For Xiaomi R3D versions prior to 2.26.4, update to version 2.26.4 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-14010

Produtos afetados

Xiaomi R3

Xiaomi R3D

Referências · 4

• 🔥 https://github.com/cc-crack/router/blob/master/CNVD-2018-04521.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14010 · Nota de Segurança
• http://cnvd.org.cn/flaw/show/CNVD-2018-04521 · Nota
• https://osv.dev/vulnerability/CVE-2018-14010 · Aviso do Fabricante