Xiaomi

Records28All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

Xiaomi records in CISA KEV

No Xiaomi vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fileexplorer 1 record MEDIUM Mitalk Messenger 1 record LOW

Records

28 records

TI-2023-11468 CVE-2023-26315 · GHSA-78wv-wpmf-ghfp

Xiaomi router has a command injection vulnerability after authorization

MEDIUM 56

The Xiaomi router AX9000 has a post-authentication command injection vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.19392 Published 2024-08-26 No fix listed CWE-78

TI-2026-23331 CVE-2026-29515 · GHSA-9238-xf4h-w28w

MiCode FileExplorer SwiFTP Server Authentication Bypass

MEDIUM 49

MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00563 Published 2026-03-11 No fix listed CWE-303

TI-2024-04103 CVE-2024-4406 · GHSA-gvj9-724p-cxwf

Cross-site scripting in Xiaomi Pro 13

MEDIUM 47

Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02236 Published 2024-05-02 No fix listed CWE-79

TI-2020-11037 CVE-2020-14095 · GHSA-mv2w-3xc9-rf23

Out-of-bounds write in Xiaomi router R3600

MEDIUM 47

In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02333 Published 2020-06-24 No fix listed CWE-787

TI-2020-11036 CVE-2020-14094 · GHSA-33m9-pfw5-gmf2

Out-of-bounds write in Xiaomi router R3600

MEDIUM 47

In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02333 Published 2020-06-24 No fix listed CWE-787

TI-2024-04102 CVE-2024-4405 · GHSA-5cf2-gv4g-4g88

Cross-site scripting in Xiaomi Pro 13

MEDIUM 45

Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01232 Published 2024-05-02 No fix listed CWE-79

TI-2023-11477 CVE-2023-26324 · GHSA-xmm6-6gqm-6vjq

GetApps application has code execution vulnerability

MEDIUM 44

A code execution vulnerability exists in the XiaomiGetApps application product.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00637 Published 2024-08-28 No fix listed CWE-94

TI-2023-11475 CVE-2023-26322 · GHSA-fp9x-9r68-jr5q

GetApps application has code execution vulnerability

MEDIUM 44

A code execution vulnerability exists in the XiaomiGetApps application product.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00778 Published 2024-08-28 No fix listed CWE-94

TI-2023-11474 CVE-2023-26321 · GHSA-gmjg-rc78-3h37

The international version of Xiaomi File Manager has a path traversal vulnerability

MEDIUM 44

A path traversal vulnerability exists in the Xiaomi File Manager application product(international version).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00549 Published 2024-08-28 No fix listed CWE-22

TI-2023-11470 CVE-2023-26317 · GHSA-x3cm-94m2-6vw4

Xiaomi router external request interface has command injection

MEDIUM 44

Xiaomi routers have an external interface that can lead to command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01109 Published 2023-08-02 No fix listed CWE-78

TI-2024-30413 CVE-2024-45347 · GHSA-g6wx-2x5f-44mv

Mi Connect Service APP protocol flaws lead to unauthorized access

MEDIUM 43

An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00279 Published 2025-06-23 No fix listed CWE-287

TI-2023-11476 CVE-2023-26323 · GHSA-3mjr-8v4p-9qf4

Xiaomi App Market has a code execution vulnerability

MEDIUM 43

A code execution vulnerability exists in the Xiaomi App market product.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00581 Published 2024-08-28 No fix listed CWE-95

TI-2019-10004 CVE-2019-13322 · GHSA-r25p-q9wq-rv8q

Improper input validation in Xiaomi Browser

MEDIUM 43

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02554 Published 2020-02-10 Fixed in 10.4.0 CWE-356

TI-2019-04780 CVE-2019-6743 · GHSA-64gc-xrvh-3pxm

Out-of-bounds write in Xiaomi Browser

MEDIUM 43

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02446 Published 2019-06-03 Fixed in 10.4.0 CWE-787

TI-2024-30414 CVE-2024-45348 · GHSA-jpc2-3rcq-mchp

Command injection in Xiaomi Router AX9000

MEDIUM 42

Xiaomi Router AX9000 has a post-authorization command injection vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00819 Published 2024-09-23 No fix listed CWE-77

TI-2024-30416 CVE-2024-45352 · GHSA-mm94-j6p9-32xj

Xiaomi smarthome application Webview has code execution vulnerability

MEDIUM 40

An code execution vulnerability exists in the Xiaomi smarthome application product.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00286 Published 2025-03-27 No fix listed CWE-346

TI-2024-30412 CVE-2024-45346 · GHSA-wm5r-jw2j-wfcp

GetApps application has code execution vulnerability

MEDIUM 40

The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional securi…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00472 Published 2024-08-28 No fix listed CWE-287

TI-2023-11473 CVE-2023-26320 · GHSA-wjgc-gw8v-m4vg

Xiaomi Router external request interface vulnerability leads to stack overflow

MEDIUM 40

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01139 Published 2023-10-11 Fixed in fw version before 2023.2 CWE-120

TI-2019-10003 CVE-2019-13321 · GHSA-v8fr-hv57-w55f

Incorrect permission assignment in Xiaomi Browser

LOW 37

This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0.

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.01248 Published 2020-02-10 Fixed in 10.4.0 CWE-732

TI-2023-11472 CVE-2023-26319 · GHSA-4j9w-xhrc-q5vq

Xiaomi Router administration interface vulnerability leads command injection and stack overflow

LOW 36

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00975 Published 2023-10-11 Fixed in fw version before 2023.2 CWE-120

TI-2024-30415 CVE-2024-45351 · GHSA-c37p-8677-9fjp

Game center application has code execution Vulnerability

LOW 35

A code execution vulnerability exists in the Xiaomi Game center application product.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00189 Published 2025-03-26 No fix listed CWE-1284

TI-2023-11471 CVE-2023-26318 · GHSA-qm2m-hfw4-jq7f

Xiaomi router web interface post-authorization stack overflow

LOW 34

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2023-10-11 Fixed in fw version before 2023.2 CWE-120

TI-2024-30420 CVE-2024-45356 · GHSA-rx8f-q5hr-3gm3

Xiaomi phone framework has unauthorized access vulnerability

LOW 33

A unauthorized access vulnerability exists in the Xiaomi phone framework.

CVSS 3.1HIGH 7.3 Local No auth User interaction EPSS 0.00158 Published 2025-03-27 No fix listed CWE-306

TI-2011-04040 CVE-2011-4697 · GHSA-6cqh-6m8g-v98m

The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android…

LOW 31

The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01047 Published 2012-01-25 No fix listed CWE-200

TI-2024-30421 CVE-2024-45361 · GHSA-rjr7-mrw5-5m4x

Mi Connect Service APP protocol flaws lead to leaking sensitive user information

LOW 28

A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00172 Published 2025-03-27 No fix listed CWE-319

Open these records in search →