CVE-2018-14010: OS Command Injection
First published: Sun Jul 15 2018(Updated: )
OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mi Xiaomi R3p Firmware | <2.14.5 | |
| Mi Xiaomi R3p | ||
| Mi Xiaomi R3c Firmware | <2.12.15 | |
| Mi Xiaomi R3c | ||
| Mi Xiaomi R3d Firmware | <2.26.4 | |
| Mi Xiaomi R3d | ||
| Mi Xiaomi R3 | <2.22.15 | |
| Mi Xiaomi R3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/mi
- canonical/mi xiaomi r3p firmware
- canonical/mi xiaomi r3p
- canonical/mi xiaomi r3c firmware
- canonical/mi xiaomi r3c
- canonical/mi xiaomi r3d firmware
- canonical/mi xiaomi r3d
- canonical/mi xiaomi r3