Xiaomi
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Xiaomi Router | 4 | – | Oct 11, 2023 |
| GetApps application | 3 | – | Aug 28, 2024 |
| Xiaomi Mi Connect Service | 2 | – | Jun 23, 2025 |
| Xiaomi router R3600 | 2 | – | Jun 24, 2020 |
| Pro 13 | 2 | – | May 2, 2024 |
| Xiaomi phone framework | 1 | – | Mar 27, 2025 |
| Xiaomi phone framework has unauthorized access vulnerability | 1 | – | Mar 27, 2025 |
| Xiaomi Router AX9000 | 1 | – | Sep 23, 2024 |
| Xiaomi shop application | 1 | – | Mar 27, 2025 |
| App Market | 1 | – | Aug 28, 2024 |
| Xiaomi smarthome application | 1 | – | Mar 27, 2025 |
| Game center application | 1 | – | Mar 26, 2025 |
| quick app framework | 1 | – | Mar 27, 2025 |
| Router AX9000 | 1 | – | Aug 26, 2024 |
| Xiaomi File Manager App International Version | 1 | – | Aug 28, 2024 |
Exploited and recent CVEs
- CVE-2024-45347 Mi Connect Service APP protocol flaws lead to unauthorized access 0.3%
- CVE-2024-45361 Mi Connect Service APP protocol flaws lead to leaking sensitive user information 0.2%
- CVE-2024-45356 Xiaomi phone framework has unauthorized access vulnerability 0.2%
- CVE-2024-45355 Xiaomi phone framework has unauthorized access vulnerability 0.1%
- CVE-2024-45354 xiaomi shop application Webview has code execution vulnerability 0.2%
- CVE-2024-45353 quick App has intent redriction vulnerability 0.2%
- CVE-2024-45352 Xiaomi smarthome application Webview has code execution vulnerability 0.3%
- CVE-2024-45351 Game center application has code execution Vulnerability 0.2%
- CVE-2024-45348 Xiaomi Router AX9000 has a post-authorization command injection vulnerability 0.8%
- CVE-2023-26322 GetApps application has code execution vulnerability 0.8%
- CVE-2023-26323 Xiaomi App Market has a code execution vulnerability 0.6%
- CVE-2023-26321 The international version of Xiaomi File Manager has a path traversal vulnerability 0.5%
- CVE-2023-26324 GetApps application has code execution vulnerability 0.6%
- CVE-2024-45346 GetApps application has code execution vulnerability 0.5%
- CVE-2023-26315 Xiaomi router has a command injection vulnerability after authorization 19.4%
- CVE-2024-4406 Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability 2.2%
- CVE-2024-4405 Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability 1.2%
- CVE-2023-26320 Xiaomi Router external request interface vulnerability leads to stack overflow 1.1%
- CVE-2023-26319 Xiaomi Router administration interface vulnerability leads command injection and stack overflow 1.0%
- CVE-2023-26318 Xiaomi router web interface post-authorization stack overflow 0.6%
- CVE-2023-26317 Xiaomi router external request interface has command injection 1.1%
- CVE-2020-14094 In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution. 2.3%
- CVE-2020-14095 In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution. 2.3%