Vulnerability · Published Aug 2, 2023 · Assigned by Xiaomi
CVE-2023-26317Xiaomi router external request interface has command injection
High 7.0
In plain English
A high-severity OS command injection in Xiaomi router from Xiaomi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xiaomi | Xiaomi router | Xiaomi Router Firmware version before 2023.2 – through 2023.2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L