Xiaomi Mi Router 3 Command Injection Vulnerability

Xiaomi Mi Router 3 is a wireless router product from Chinese company Xiaomi. A system command injection vulnerability exists in the requestmitv endpoint in Xiaomi Mi Router 3 version 2.22.15. The vulnerability can be exploited to execute arbitrary system commands with the 'payload' URL parameter...

CVE-2018-16130

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

PT-2018-13414

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15 Description The issue allows attackers to execute arbitrary system commands via the payload variable in the request mitv function. This can be achieved by manipulating the "payload" URL parameter...