PT-2026-7854 · Xiaomi+1 · Galaxy Fds Android Sdk+1

Vulncheck + 1 · Publicado 2026-02-12 · Atualizado 2026-02-20 · CVE-2026-26214

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versions prior to 3.0.9

Description The Galaxy FDS Android SDK disables TLS hostname verification when HTTPS is enabled by default. Specifically, the createHttpClient() function within the GalaxyFDSClientImpl class configures Apache HttpClient with SSLSocketFactory.ALLOW ALL HOSTNAME VERIFIER, accepting any TLS certificate regardless of hostname mismatch. This allows a man-in-the-middle attacker to intercept and modify communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.

Recommendations Versions prior to 3.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

CVE-2026-26214

Produtos afetados

Apache Httpclient

Galaxy Fds Android Sdk

Referências · 8

• 🔥 https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md · Exploit
• https://github.com/XiaoMi/galaxy-fds-sdk-android · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26214 · Nota de Segurança
• https://twitter.com/CVEnew/status/2021980016205341113 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2021997587750871543 · Publicação no Twitter
• https://vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm · Nota
• https://t.me/cveNotify/152598 · Publicação no Telegram
• https://t.me/CVEtracker/44540 · Publicação no Telegram