CVE-2024-45352
HIGHXiaomi smarthome application 10.0.623 - Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-45352. PoCs published by Edwins907.
AI-analyzed exploit summary The repository provides a functional proof-of-concept for CVE-2024-45352, demonstrating unauthenticated remote code execution in Xiaomi Smarthome via a crafted API request. The PoC leverages improper input handling in the internal API parser to execute arbitrary commands.
Description
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
Exploits (3)
The repository provides a functional proof-of-concept for CVE-2024-45352, demonstrating unauthenticated remote code execution in Xiaomi Smarthome via a crafted API request. The PoC leverages improper input handling in the internal API parser to execute arbitrary commands.
The repository contains only a minimal README with a CVE title and no technical details, exploit code, or analysis. It appears to be a placeholder without substantive content.
The repository contains a functional Proof of Concept (PoC) for CVE-2024-45352, demonstrating how a malicious app can exploit Xiaomi's default browser by passing unvalidated intents via `startActivity` to open arbitrary URLs. The PoC includes Java code to launch the browser with a malicious URL, highlighting the lack of intent validation.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H