Jian-Xian

8 exploits Active since Mar 2020
CVE-2020-10262 GITHUB MEDIUM WRITEUP
XIAOMI XIAOAI speaker Pro LX06 <1.58.10 - Info Disclosure
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the mi_console command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro (LX06), (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’s SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
10 stars
CVSS 6.8
CVE-2020-10263 GITHUB MEDIUM WRITEUP
XIAOMI XIAOAI Speaker Pro LX06 1.52.4 - Unauthenticated Root Shell Access via UART Interface
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro LX06, (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’ SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
10 stars
CVSS 6.8
CVE-2020-8994 GITHUB MEDIUM WRITEUP
XIAOMI AI Speaker MDZ-25-DT Firmware 1.34.36 and 1.40.14 - Unauthenticated Root Shell Access via UART Interface
An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor
10 stars
CVSS 6.8
CVE-2021-33818 GITHUB HIGH WRITEUP
UniFi Protect G3 FLEX Camera UVC.v4.30.0.67 - Denial of Service via Incomplete HTTP Request
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
10 stars
CVSS 7.5
CVE-2021-33820 GITHUB HIGH WRITEUP
UniFi Protect G3 FLEX Camera <UVC.v4.30.0.67 - DoS
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
10 stars
CVSS 7.5
CVE-2021-33822 GITHUB HIGH WRITEUP
4GEE ROUTER HH70VB Firmware HH70_E1_02.00_22 - Denial of Service via Incomplete HTTP Request
An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
10 stars
CVSS 7.5
CVE-2021-33823 GITHUB HIGH WRITEUP
MOXA Mgate MB3180 2.1 Build 18113012 - Denial of Service via TCP SYN Flood
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. Then the web server is denial-of-service.
10 stars
CVSS 7.5
CVE-2021-33824 GITHUB HIGH WRITEUP
MOXA Mgate MB3180 2.1 Build 18113012 - Denial of Service via Incomplete HTTP Request
An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service.
10 stars
CVSS 7.5