Xiaomi Router 命令注入漏洞

Xiaomi Router is a series of wireless routers from the Chinese company Xiaomi. A command injection vulnerability exists in Xiaomi Router. The vulnerability is due to insufficient screening of responses returned from an external interface. An attacker could use this vulnerability to gain privilege...

Xiaomi Router 命令注入漏洞

Xiaomi router is a series of wireless routers from the Chinese company Xiaomi. Xiaomi Router suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters. An attacker could exploit this vulnerability to execute arbitrary comman...

PT-2023-20612 · Xiaomi · Xiaomi Router

Name of the Vulnerable Software and Affected Versions: Xiaomi Router affected versions not specified Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a Command Injection. This allows for Command Injection in the Xiaomi Router...

PT-2023-20610 · Xiaomi · Xiaomi Router

Name of the Vulnerable Software and Affected Versions: Xiaomi Router affected versions not specified Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as Command Injection. This allows for Command Injection in the Xiaomi Router...

PT-2023-20609 · Xiaomi · Xiaomi Router

Name of the Vulnerable Software and Affected Versions: Xiaomi Router affected versions not specified Description: The issue is related to a Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow'. This allows for Overflow Buffers in the Xiaomi Router. Recommendations...

Xenomorph Banking Trojan: A New Variant Targeting 35+ U.S. Financial Institutions

An updated version of an Android banking trojan called Xenomorph has set its sights on more than 35 financial institutions in the U.S. The campaign, according to Dutch security firm ThreatFabric, leverages phishing web pages that are designed to entice victims into installing malicious Android ap...

Xiaomi router command injection vulnerability (CNVD-2025-06298)

Xiaomi router is a series of wireless routers from the Chinese company Xiaomi. Xiaomi routers suffer from a command injection vulnerability that stems from insufficient filtering of responses returned by the external interface, which can be exploited by an attacker to gain privileges by hijacking...

Xiaomi cloud service Application cross-site scripting vulnerability

Xiaomi cloud service Application is a cloud service APP from Xiaomi, a Chinese company. A cross-site scripting vulnerability exists in Xiaomi cloud service Application, which stems from a whitelist checking feature that allows loading of the javascript protocol, which can be exploited by an...

CVE-2023-26317

Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing...

CVE-2023-26317

Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing...

CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

CVE-2023-26317

Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing...

Cross site scripting

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

Command injection

A vulnerability has been discovered in Xiaomi routers that could allow command injection through an external interface. This vulnerability arises from inadequate filtering of responses returned from the external interface. Attackers could exploit this vulnerability by hijacking the ISP or an...

CVE-2023-26316

The CVE-2023-26316 entry concerns a cross-site scripting (XSS) vulnerability in the Xiaomi cloud service Application product. The issue arises from Webview’s whitelist checking function, which may allow loading the javascript protocol, enabling an attacker to steal Xiaomi cloud service account co...

Xiaomi router 命令注入漏洞

Xiaomi router is a series of wireless routers from the Chinese company Xiaomi. Xiaomi routers suffer from a command injection vulnerability that stems from insufficient filtering of responses returned by the external interface, which can be exploited by an attacker to gain privileges by hijacking...

PT-2023-20608 · Xiaomi · Xiaomi Router

Name of the Vulnerable Software and Affected Versions: Xiaomi routers affected versions not specified Description: The issue is caused by inadequate filtering of responses from external interfaces, leading to command injection. Attackers can exploit this by hijacking the ISP or upper-layer routin...

CVE-2023-26317

The CVE-2023-26317 entry concerns Xiaomi routers with an external interface that can be abused to perform command injection. The root cause is lax filtering of responses from the external interface, enabling an attacker to hijack ISP routing or an upper-layer route to gain unauthorized access and...