PT-2026-7854 · Xiaomi+1 · Galaxy Fds Android Sdk+1

Vulncheck + 1 · Published 2026-02-12 · Updated 2026-02-20 · CVE-2026-26214

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versions prior to 3.0.9

Description The Galaxy FDS Android SDK disables TLS hostname verification when HTTPS is enabled by default. Specifically, the createHttpClient() function within the GalaxyFDSClientImpl class configures Apache HttpClient with SSLSocketFactory.ALLOW ALL HOSTNAME VERIFIER, accepting any TLS certificate regardless of hostname mismatch. This allows a man-in-the-middle attacker to intercept and modify communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.

Recommendations Versions prior to 3.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2026-26214

Affected Products

Apache Httpclient

Galaxy Fds Android Sdk

References · 8

• 🔥 https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26214 · Security Note
• https://github.com/XiaoMi/galaxy-fds-sdk-android · Note
• https://twitter.com/CVEnew/status/2021980016205341113 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021997587750871543 · Twitter Post
• https://vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm · Note
• https://t.me/cveNotify/152598 · Telegram Post
• https://t.me/CVEtracker/44540 · Telegram Post