xmir-patcher

XMiR-Patcher Firmware patcher for Xiaomi routers Usage Windows Run run.bat Linux / Mac OS Install python 3.8+ and openssl Run run.sh Donations...

CVE-2026-43499-popsicle

CVE-2026-43499 for popsicle This repository contains an Android 16 local privilege escalation implementation for CVE-2026-43499 on Xiaomi 17 Pro Max popsicle. Verified kernel: 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k Devices with this kernel Xiaomi 17, Pro, and Ultra series have all...

android_kernel_xiaomi_sunny

Linux kernel This file was moved to Documentation/admin-guide/README.rst Please notice that there are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. In order to build the documentation, use make htmldocs or make pdfdocs. The...

cve-2026-98260-nezha

CVE-2026-98260 · Xiaomi 17 Ultra nezha temporary root + KernelSU PoC 从一台已授权 ADB、bootloader 锁定、SELinux Enforcing 的小米 17 Ultra 出发， 利用 POSIX CPU timer 在 exec 中的 use-after-free 拿到当前开机周期内 的 uid=0 + 完整 capabilities，再用这个 root 把 KernelSU 模块 late-load 进内核， 得到 KSU 管理的 su。 This is temporary root : as soon a...

CVE-2026-43499-aristotle

CVE-2026-43499 — aristotle au/KDDI Xiaomi XIG04 Local privilege escalation tmp-root for the au/KDDI Xiaomi "aristotle" XIG04 on Android 12 , via CVE-2026-43499. It is a device-owner rooting primitive: it roots your own phone e.g. to re-enable ADB when developer options are unreachable. This is an...

android_kernel_xiaomi_sm8150

This repository does not have a README...

cve-2024-4406-xiaomi13pro-exploit-files

cve-2024-4406-xiaomi13pro-exploit-files Files related to the Pwn2Own Toronto 2023 exploit against the Xiaomi 13 Pro...

CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection

CVE-2026-26898: Xiaomi Mi Router 4A Gigabit - SSRF via Host Header Injection -orange Summary A Server-Side Request Forgery SSRF vulnerability exists in the Xiaomi Mi Router 4A Gigabit Edition. The router's web interface fails to validate the HTTP Host header, allowing an unauthenticated attacker ...

CVE-2026-64560-public

CVE-2026-64560 Staged Research Engineering Security research and auditable engineering sample on Xiaomi 18 Pro M610BB / SM8950 / Android 17 / kernel 6.18.21. This repository is compiled from the latest README, process reports, and staged source code of CVE-2026-64560-fullchain. The goal is to let...

CVE-2026-98260-pudding-android

CVE-2026-98260 · Android 17 / pudding Local Privilege Escalation Port An Android AArch64 exploit chain targeting a precise kernel build of the Xiaomi 17 codename pudding: starting from an ordinary ADB shell, it sequentially sets SELinux to Permissive, zeroes the UID/GID of the current process,...

CVE-2026-43499-warhol-root

warhol-root CVE-2026-43499 IonStack local privilege escalation, ported to the Xiaomi 17T Pro warhol — MediaTek MT6993, Android 16. GKI 6.12 / android16 only. The waiter overlay, the pselect stack layout and every struct offset are pinned to that branch, so nothing here transfers to 6.6, 6.1 or 5....

CVE-2026-43499-aristotle-apk

Aristotle ADB Enable A minimal Android app that turns on ADB on an au/KDDI Xiaomi "aristotle" XIG04, Android 12 whose developer options can't be reached, using a temporary root obtained from CVE-2026-43499. It is a device-owner tool in the same category as KingRoot: it roots your own phone to fli...

CVE-2020-0069_poc

Description This repository contains the materials we used to investigate CVE-2020-0069 on a Xiaomi Redmi 6a with a Mediatek SoC MT6762M. There are three programs: kernelrw.c a C program allowing to read/write kernel memory poc.sh a shell script syscallhook.c a C library that can be used to trace...

CVE-2026-43499-For-Xiaomi-17T-chagall

CVE-2026-43499-For-Xiaomi-17T-chagall CVE-2026-43499 reproduce in Xiaomi 17T. tested on .307 version,it got fixed when I upgraded to A17 which also upgraded to 6.6.118-android15-8-gc4127a25dcf3-ab158633 37-4k so not working...

dirtyfrag-research

Kernel Exploit Research — Xiaomi 5.4-qgki veux & moonstone Date: 2026-10-07/08 Devices: Redmi Note 11 Pro 5G veux, 5.4.274-qgki & POCO X5 5G moonstone, 5.4.191-qgki SoC: Snapdragon 695 SM6375 Summary CVE| Status| Notes ---|---|--- CVE-2026-43284 DirtyFrag| ❌ Dead| Needs MSGSPLICEPAGES kernel 6.5+...

CVE-2026-98260-pandora-lpe

CVE-2026-98260 · Xiaomi 17 Pro pandora Local Privilege Escalation An in-memory root tool targeting Xiaomi 17 Pro pandora / 25098PN5AC / OS4.0.5.0.XBLCNXM / kernel 6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k. No need to unlock the bootloader, and no partitions are flashed; Becomes invalid...

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication. id: CVE-2019-18371...

CVE-2026-98260-dada-android

CVE-2026-98260 · Xiaomi 15 dada Android 17 Port A temporary local privilege escalation PoC targeting OS4.0.0.22.XOCCNXM and its exact kernel build. CVE-2026-98260 has been reproduced on a real device from an ordinary ADB shell, obtaining SELinux Permissive and UID/GID 0 within the same boot cycle...

HyperOS-Directory-Traversal-Analysis

🔬 CVE-2025-21082: HyperOS AVCodec Use-After-Free Comprehensive Analysis of the Use-After-Free Vulnerability in Xiaomi HyperOS AVCodec Media Framework and Simulation with Rust University Final Project — Cybersecurity Research Project 🌐 Experience the Live Simulation in Browser 📖 About the Project...

CVE-2026-98260-nezha-android

CVE-2026-98260 · Xiaomi 17 Ultra nezha Android Port This is a temporary local privilege escalation PoC targeting an exact firmware and kernel build. Starting from an authorized ordinary ADB shell, it separately verifies SELinux Permissive, UID/GID 0, and full Linux capabilities, and provides a ro...