Zhiniang Peng from Qihoo 360 Core Security

4 exploits Active since Oct 2019
CVE-2019-18371 NOMISEC HIGH WORKING POC
Millet Router 3G Firmware < 2.28.23 - Unauthenticated Path Traversal via NGINX Alias Misconfiguration
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
186 stars
CVSS 7.5
CVE-2019-18371 NOMISEC HIGH WORKING POC
Millet Router 3G Firmware < 2.28.23 - Unauthenticated Path Traversal via NGINX Alias Misconfiguration
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
CVSS 7.5
CVE-2019-18370 WRITEUP CRITICAL WORKING POC
Millet Router 3G Firmware < 2.28.23 - OS Command Injection
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed.
CVSS 9.8
CVE-2019-18371 WRITEUP HIGH WORKING POC
Millet Router 3G Firmware < 2.28.23 - Unauthenticated Path Traversal via NGINX Alias Misconfiguration
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
CVSS 7.5