CVE-2018-14010: Command Injection
OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14010?
CVE-2018-14010 is considered a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2018-14010?
To fix CVE-2018-14010, update the firmware of your Xiaomi R3P, R3C, R3, or R3D devices to the latest versions which are free from this vulnerability.
What type of vulnerability is CVE-2018-14010?
CVE-2018-14010 is an OS command injection vulnerability targeting the guest Wi-Fi settings feature in specific Xiaomi router firmware versions.
Which Xiaomi devices are affected by CVE-2018-14010?
Xiaomi devices affected by CVE-2018-14010 include R3P, R3C, R3, and R3D running firmware versions prior to their respective safe updates.
Can CVE-2018-14010 be exploited remotely?
Yes, CVE-2018-14010 can be exploited remotely using crafted JSON data to execute arbitrary commands on vulnerable devices.