CVE-2023-26315CWE-78
Xiaomi router has a command injection vulnerability after authorization
Medium · published August 26, 2024
What it is
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.19392 · 97.4th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2024-08-26T11:47Z
EPSS history
Timeline