Priority MEDIUM 49
MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00563 · Published 2026-03-11 · No fix listed CWE-303
Priority MEDIUM 43
An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP.
CVSS 3.1CRITICAL 9.6· Adjacent network · No auth · No interaction · EPSS 0.00279 · Published 2025-06-23 · No fix listed CWE-287
Priority LOW 28
A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP.
CVSS 3.1MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.00172 · Published 2025-03-27 · No fix listed CWE-319
Priority LOW 33
A unauthorized access vulnerability exists in the Xiaomi phone framework.
CVSS 3.1HIGH 7.3· Local · No auth · User interaction · EPSS 0.00158 · Published 2025-03-27 · No fix listed CWE-306
Priority LOW 24
A unauthorized access vulnerability exists in the Xiaomi phone framework.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00148 · Published 2025-03-27 · No fix listed CWE-306
Priority LOW 19
A code execution vulnerability exists in the Xiaomi shop applicationproduct.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00206 · Published 2025-03-27 · No fix listed CWE-346
Priority LOW 19
An intent redriction vulnerability exists in the Xiaomi quick App framework application product.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00162 · Published 2025-03-27 · No fix listed CWE-346
Priority MEDIUM 40
An code execution vulnerability exists in the Xiaomi smarthome application product.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00286 · Published 2025-03-27 · No fix listed CWE-346
Priority LOW 35
A code execution vulnerability exists in the Xiaomi Game center application product.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00189 · Published 2025-03-26 · No fix listed CWE-1284
Priority MEDIUM 42
Xiaomi Router AX9000 has a post-authorization command injection vulnerability.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00819 · Published 2024-09-23 · No fix listed CWE-77
Priority MEDIUM 44
A code execution vulnerability exists in the XiaomiGetApps application product.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00778 · Published 2024-08-28 · No fix listed CWE-94
Priority MEDIUM 43
A code execution vulnerability exists in the Xiaomi App market product.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00581 · Published 2024-08-28 · No fix listed CWE-95
Priority MEDIUM 44
A path traversal vulnerability exists in the Xiaomi File Manager application product(international version).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00549 · Published 2024-08-28 · No fix listed CWE-22
Priority MEDIUM 44
A code execution vulnerability exists in the XiaomiGetApps application product.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00637 · Published 2024-08-28 · No fix listed CWE-94
Priority MEDIUM 40
The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional securi…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00472 · Published 2024-08-28 · No fix listed CWE-287
Priority MEDIUM 56
The Xiaomi router AX9000 has a post-authentication command injection vulnerability.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.19392 · Published 2024-08-26 · No fix listed CWE-78
Priority MEDIUM 47
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.02236 · Published 2024-05-02 · No fix listed CWE-79
Priority MEDIUM 45
Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01232 · Published 2024-05-02 · No fix listed CWE-79
Priority MEDIUM 40
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01139 · Published 2023-10-11 · Fixed in fw version before 2023.2 CWE-120
Priority LOW 36
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00975 · Published 2023-10-11 · Fixed in fw version before 2023.2 CWE-120
Priority LOW 34
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00586 · Published 2023-10-11 · Fixed in fw version before 2023.2 CWE-120
Priority MEDIUM 44
Xiaomi routers have an external interface that can lead to command injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01109 · Published 2023-08-02 · No fix listed CWE-78
Priority MEDIUM 47
In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02333 · Published 2020-06-24 · No fix listed CWE-787
Priority MEDIUM 47
In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02333 · Published 2020-06-24 · No fix listed CWE-787
Priority MEDIUM 43
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02554 · Published 2020-02-10 · Fixed in 10.4.0 CWE-356
Load more
THREATIST.IORead the docs