Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14010

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.

Published

2018-07-15T03:29:00.227

Last Modified

2024-11-21T03:48:26.510

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System mi xiaomi_r3p_firmware < 2.14.5 Yes
Hardware mi xiaomi_r3p - No
Operating System mi xiaomi_r3c_firmware < 2.12.15 Yes
Hardware mi xiaomi_r3c - No
Operating System mi xiaomi_r3d_firmware < 2.26.4 Yes
Hardware mi xiaomi_r3d - No
Operating System mi xiaomi_r3 < 2.22.15 Yes
Hardware mi xiaomi_r3 - No
References