PT-2018-13414 · Xiaomi · Xiaomi Mi Router 3

Publicado 2018-11-27 · Atualizado 2019-10-03 · CVE-2018-16130

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15

Description The issue allows attackers to execute arbitrary system commands via the payload variable in the request mitv function. This can be achieved by manipulating the "payload" URL parameter.

Recommendations For Xiaomi Mi Router 3 version 2.22.15, consider restricting access to the request mitv function until a patch is available. As a temporary workaround, avoid using the payload variable in the affected URL parameter to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-16130

Produtos afetados

Xiaomi Mi Router 3

Referências · 3

• 🔥 https://blog.securityevaluators.com/hack-routers-get-toys-exploiting-the-mi-router-3-1d7fd42f0838 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16130 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16130 · Aviso do Fabricante