Pwn2Own Trifecta: Galaxy S9, iPhone X and Xiaomi Mi6 Fall to Hackers

Three major mobile phone models – the Samsung Galaxy S9, iPhone X and the Xiaomi Mi6 – failed to survive the hacker onslaught at this year’s Pwn2Own Tokyo 2018. In all, 18 exploits, with some attacks chaining together as many as five exploits, were used to own the three phones and earn hacker tea...

Code execution vulnerability in Xiaomi Router R1D

Xiaomi Router R1D is a router. A code execution vulnerability exists in Xiaomi Router R1D. An attacker can exploit the vulnerability to execute arbitrary code...

Xiaomi Router 4Q suffers from command execution vulnerability

The Xiaomi Router 4Q is a router. A command execution vulnerability exists in Xiaomi Router 4Q. An attacker can exploit the vulnerability to remotely execute arbitrary code...

Command execution vulnerability at root level in Xiaomi Router 3A user management page

Xiaomi Router 3A is a router. A command execution vulnerability exists at the root level of the Xiaomi Router 3A user management page. An attacker can exploit the vulnerability to remotely execute arbitrary code...

Command execution vulnerability at root level in Xiaomi Router 4 user management page

The Xiaomi Router 4 is a router. A command execution vulnerability exists at the root level of the Xiaomi Router 4 user management page. An attacker can exploit the vulnerability to remotely execute arbitrary code...

CVE-2018-16307

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

CVE-2018-16307

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

Design/Logic Flaw

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

CVE-2018-16307

The CVE-2018-16307 entry applies to Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50. The vulnerability is an Out-of-band resource load in the router’s web interface: if an attacker sends a request with a Host header containing a domain, the device fetches that external URL and returns the fetched conten...

CVE-2018-16307

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

Xiaomi MIWiFi Xiaomi_55DD Resource Loading Vulnerability

Xiaomi MIWiFi Xiaomi55DD is a wireless router from the Chinese company Xiaomi. A security vulnerability exists in Xiaomi MIWiFi Xiaomi55DD version 2.8.50. An attacker can exploit this vulnerability to cause the application to retrieve the contents of arbitrary external URLs and return those...

Xiaomi MIWiFi Xiaomi_55DD 2.8.50 Out-Of-Band Resource Load Vulnerability

An out-of-band resource load issue was discovered on Xiaomi MIWiFi Xiaomi55DD version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used i...

MIWiFi Xiaomi_55DD 2.8.50 Out-Of-Band Resource Load

CVE: CVE-2018-16307 Issue: Out-of-band resource load Product affected: MIWiFi Xiaomi55DD Version 2.8.50 Summary: An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrar...

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

Command injection

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14060

OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/setrouterwifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

Command injection

OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/setrouterwifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14060

OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/setrouterwifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data...