Vulnerability Description
OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mi | Xiaomi R3D Firmware | < 2.26.4 |
| Mi | Xiaomi R3D | - |
Related Weaknesses (CWE)
References
- http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520Third Party Advisory
- https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.pyExploitThird Party Advisory
- http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520Third Party Advisory
- https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.pyExploitThird Party Advisory
FAQ
What is CVE-2018-14060?
CVE-2018-14060 is a vulnerability with a CVSS score of 9.8 (CRITICAL). OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON dat...
How severe is CVE-2018-14060?
CVE-2018-14060 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-14060?
Check the references section above for vendor advisories and patch information. Affected products include: Mi Xiaomi R3D Firmware, Mi Xiaomi R3D.