Read the docs
TI-2023-11473 Aliases CVE-2023-26320GHSA-wjgc-gw8v-m4vg

Xiaomi Router external request interface vulnerability leads to stack overflow

Priority MEDIUM 40CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01139 66th percentileScored 2026-11-07
Fix Fixed Xiaomi Router (Xiaomi): fw version before 2023.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XiaomiXiaomi Routerbefore fw version before 2023.2fw version before 2023.2Patch availableCNA
  • Xiaomi Router VendorXiaomi Affected before fw version before 2023.2 Fixed in fw version before 2023.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:mi:xiaomi_router_ax3200_firmware:*:*:*:*:*:*:*:*before 2023.2VulnerableMi
cpe:2.3:h:mi:xiaomi_router_ax3200:-:*:*:*:*:*:*:*not specified by NVDRunning onMi
  • cpe:2.3:o:mi:xiaomi_router_ax3200_firmware:*:*:*:*:*:*:*:* Versions before 2023.2 Vulnerable ·Mi
  • cpe:2.3:h:mi:xiaomi_router_ax3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mi

Remediation

  • Fix · CNA Xiaomi Router (Xiaomi) Fixed in fw version before 2023.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xiaomi Router fw version before 2023.2

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2023-11472 Xiaomi Router administration interface vulnerability leads command injection and stack overflowPriority LOW 36
    • TI-2023-11471 Xiaomi router web interface post-authorization stack overflowPriority LOW 34
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26320
  2. 2026-10-03 Alias added: GHSA-wjgc-gw8v-m4vg

References

Advisory 1

  • TI-2023-11468 Xiaomi router has a command injection vulnerability after authorization CVSS 3.1HIGH 8.8
  • TI-2026-23331 MiCode FileExplorer SwiFTP Server Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2024-04103 Cross-site scripting in Xiaomi Pro 13 CVSS 3.1CRITICAL 9.6
  • TI-2020-11037 Out-of-bounds write in Xiaomi router R3600 CVSS 3.1CRITICAL 9.8
  • TI-2020-11036 Out-of-bounds write in Xiaomi router R3600 CVSS 3.1CRITICAL 9.8
  • TI-2024-04102 Cross-site scripting in Xiaomi Pro 13 CVSS 3.1CRITICAL 9.6
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences