CVE-2018-14060

CVE-2018-14060 describes an OS command-injection in the AP mode settings feature of Xiaomi R3D devices (pre-2.26.4) via /cgi-bin/luci/api/misystem/set_router_wifiap, allowing an attacker to execute arbitrary commands through crafted JSON data. The affected component is the router firmware’s AP mo...