PT-2018-12276 · Xiaomi · Xiaomi R3D+1

Published 2018-07-15 · Updated 2018-09-12 · CVE-2018-14010

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiaomi R3P versions prior to 2.14.5 Xiaomi R3C versions prior to 2.12.15 Xiaomi R3 versions prior to 2.22.15 Xiaomi R3D versions prior to 2.26.4

Description The issue concerns an OS command injection in the guest Wi-Fi settings feature, specifically in the /cgi-bin/luci endpoint, allowing an attacker to execute any command via crafted JSON data.

Recommendations For Xiaomi R3P versions prior to 2.14.5, update to version 2.14.5 or later. For Xiaomi R3C versions prior to 2.12.15, update to version 2.12.15 or later. For Xiaomi R3 versions prior to 2.22.15, update to version 2.22.15 or later. For Xiaomi R3D versions prior to 2.26.4, update to version 2.26.4 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-14010

Affected Products

Xiaomi R3

Xiaomi R3D

References · 4

• 🔥 https://github.com/cc-crack/router/blob/master/CNVD-2018-04521.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14010 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14010 · Vendor Advisory
• http://cnvd.org.cn/flaw/show/CNVD-2018-04521 · Note