CVE-2018-14010

CRITICAL

Xiaomi R3P/R3C/R3/R3D Firmware < 2.14.5/2.12.15/2.22.15/2.26.4 - OS Command Injection via Guest Wi-Fi Settings

Title source: llm
STIX 2.1

Description

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
http://www.cnvd.org.cn/flaw/show/CNVD-2018-04521

Scores

CVSS v3 9.8
EPSS 0.0452
EPSS Percentile 90.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (4)
mi/xiaomi_r3 < 2.22.15
mi/xiaomi_r3c_firmware < 2.12.15
mi/xiaomi_r3d_firmware < 2.26.4
mi/xiaomi_r3p_firmware < 2.14.5
Published Jul 15, 2018
Tracked Since Feb 18, 2026