CVE-2019-15468

The CVE-2019-15468 entry concerns the Xiaomi Mi A2 Lite. A pre-installed app with package name com.huaqin.factory (versionCode=1, versionName=QL1715_201812071953) on build xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys enables unauthorized wireless settings modifi...

CVE-2019-15468

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201812071953 that allows unauthorized wireles...

CVE-2019-15467

The Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=A2060201801032053 that allows unauthorized wireles...

CVE-2019-15467

CVE-2019-15467 affects Xiaomi Mi Mix 2S on Android (build fingerprint Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys). A pre-installed app with package name com.huaqin.factory app (versionCode=1, versionName=A2060_201801032053) allows unauthorized wireless settin...

CVE-2019-15466

The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakuraindia/sakuraindia:8.1.0/OPM1.171019.019/V10.2.6.0.ODMMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201812191721 that allows...

CVE-2019-15466

CVE-2019-15466 concerns a vulnerability on the Xiaomi Redmi 6 Pro (build fingerprint: xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V10.2.6.0.ODMMIXM:user/release-keys). The issue arises from a pre-installed app with package name com.huaqin.factory app that allows unauthorized wireless s...

CVE-2019-15428

The CVE-2019-15428 entry refers to a vulnerability in the Xiaomi Mi Note 2 where a pre-installed app (com.miui.powerkeeper, versionCode 40000, versionName 4.0.00) enables unauthorized wireless settings modification via a confused deputy attack. Affected device builds are Xiaomi/scorpio/scorpio:6....

CVE-2019-15428

The Xiaomi Mi Note 2 Android device with a build fingerprint of Xiaomi/scorpio/scorpio:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification vi...

CVE-2019-15427

CVE-2019-15427 affects the Xiaomi Mi Mix on build Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1.5:user/release-keys. A pre-installed package com.miui.powerkeeper (versionCode 40000, versionName 4.0.00) allows unauthorized wireless settings modification via a confused deputy attack. The vulnerability ca...

CVE-2019-15427

The Xiaomi Mi Mix Android device with a build fingerprint of Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via a...

CVE-2019-15426

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

CVE-2019-15426

CVE-2019-15426 affects the Xiaomi 5S Plus Android device (build fingerprint Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys). A pre-installed app (package com.miui.powerkeeper, versionCode 40000, versionName 4.0.00) enables unauthorized wireless settings modification via a confused de...

CVE-2019-15415

The Xiaomi Redmi 5 Android device with a build fingerprint of xiaomi/vince/vince:7.1.2/N2G47H/V9.5.4.0.NEGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1711201803291645 that allows unauthorized wireless settings...

CVE-2019-15415

CVE-2019-15415 concerns a pre-installed app on the Xiaomi Redmi 5 Android device (package com.huaqin.factory) that enables unauthorized modification of wireless settings through a confused-deputy attack. Impact is described as access by any co-located app with low CVSS but partial integrity impac...

CVE-2019-15340

The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakuraindia/sakuraindia:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201805292006 that allows any app...

CVE-2019-15340

The CVE-2019-15340 entry concerns Xiaomi Redmi 6 Pro devices running Android 8.1.0 with a pre-installed app (package com.huaqin.factory app, versionCode=1, versionName=QL1715_201805292006). The app exposes an interface that lets any co-located app disable/enable Wi‑Fi, Bluetooth, and GPS without ...

Xiaomi AI Speaker-mDNS service suffers from denial of service vulnerability

Xiaomi AI Speaker is a smart speaker product from Xiaomi. A denial of service vulnerability exists in the Xiaomi AI Speaker-mDNS service. The vulnerability is caused by the program service failing to adequately determine malformed messages when parsing request messages, causing the parsing thread...

Heap corruption vulnerability in Xiaomi AI Speaker-mDNS service

Xiaomi AI Speaker is a smart speaker product from Xiaomi. A heap corruption vulnerability exists in the Xiaomi AI Speaker-mDNS service. The vulnerability is due to the program service in the parsing of the request message there is a boundary check is not strict, resulting in the arbitrary write o...

Xiaomi Mi WiFi R3G Command Injection Vulnerability

The Xiaomi Mi WiFi R3G is a 3G router from the Chinese company Xiaomi Technology. A security vulnerability exists in the Xiaomi Mi WiFi R3G backup file upload handling, which allows remote attackers to exploit the vulnerability to submit a special request that can execute arbitrary OS commands...

Xiaomi Mi WiFi R3G Path Traversal Vulnerability

The Xiaomi Mi WiFi R3G is a 3G router from China's Xiaomi Technology Xiaomi. A path traversal vulnerability in previous versions of the Xiaomi Mi WiFi R3G 2.28.23-stable, which stems from a failure of a networked system or product to properly filter for special elements in the path of a resource ...