CVE-2018-18698

An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices

published December 24, 2018

CVSS
—
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

🚨 Your Xiaomi Mi A1 might be spilling your secrets! Cleartext Wi-Fi passwords are stored in logcat during hotspot setup, leaving them wide open for anyone peeking in! 🔥 Think of it like a hotel guest leaving their room key on the front desk with their name and room number — anyone can just grab it and gain access! If someone gains access to those logcat logs, they could easily connect to your Wi-Fi network, potentially leading to data theft or unauthorized browsing. While this may not be an immediate crisis, it’s certainly a vulnerability you don’t want lurking in the shadows! ⚠️

Put simply

Think of it like a hotel guest leaving their room key on the front desk with their name and room number — anyone can just grab it and gain access! This vulnerability arises because the Xiaomi Mi A1 stores Wi-Fi passwords in logcat logs unencrypted, making it accessible to anyone who can read those logs during the hotspot setup process.

What to do

If someone gains access to those logcat logs, they could easily connect to your Wi-Fi network, potentially leading to data theft or unauthorized browsing. While this may not be an immediate crisis, it’s certainly a vulnerability you don’t want lurking in the shadows! ⚠️ To safeguard your device, avoid using this function in public spaces, and regularly clear your logcat logs. Additionally, consider updating to a newer version of the operating system if available, as this could help mitigate the risk. 🛡️ You've got this! Take these steps, and you'll secure your Wi-Fi like a pro! 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01082 · 64.7th percentile
Published
2018-12-24T17:00Z
EPSS history
Timeline
  • 24 DEC 17:00Z
    An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices
    cvelistv5