OS Command Injection in Xiaomi R3P, R3C, R3, and R3D Wi-Fi Settings

OS Command Injection in Xiaomi R3P, R3C, R3, and R3D Wi-Fi Settings

CVE-2018-14010 · HIGH Severity

AV:N/AC:L/AU:N/C:C/I:C/A:C

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.

Learn more about our Web Application Penetration Testing UK.