CVE-2018-14010

CRITICAL

Xiaomi R3p Firmware < 2.14.5 - OS Command Injection

Title source: rule
STIX 2.1

Description

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
http://www.cnvd.org.cn/flaw/show/CNVD-2018-04521

Scores

CVSS v3 9.8
EPSS 0.1076
EPSS Percentile 93.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (4)
mi/xiaomi_r3 < 2.22.15
mi/xiaomi_r3c_firmware < 2.12.15
mi/xiaomi_r3d_firmware < 2.26.4
mi/xiaomi_r3p_firmware < 2.14.5
Published Jul 15, 2018
Tracked Since Feb 18, 2026