Lucene search
HistoryAug 26, 2024 - 12:15 p.m.
CVE-2023-26315
xiaomi
ax9000
router
post-auth
command injection
vulnerability
input filtering
root access
device
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
19.6%
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
Affected configurations
Node
miax9000_firmwareRange1.0.0–1.0.174
miax9000Match-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mi | ax9000_firmware | * | cpe:2.3:o:mi:ax9000_firmware:*:*:*:*:*:*:*:* |
| mi | ax9000 | - | cpe:2.3:h:mi:ax9000:-:*:*:*:*:*:*:* |
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
19.6%
Related for NVD:CVE-2023-26315