CVE-2023-26317: Xiaomi router external request interface has command injection
A vulnerability has been discovered in Xiaomi routers that could allow command injection through an external interface. This vulnerability arises from inadequate filtering of responses returned from the external interface. Attackers could exploit this vulnerability by hijacking the ISP or an upper-layer router to gain privileges on the Xiaomi router. Successful exploitation of this flaw could permit remote code execution and complete compromise of the device.
Other sources
Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26317?
The severity of CVE-2023-26317 is critical with a CVSS score of 9.8.
What is the vulnerability in Xiaomi routers?
The vulnerability in Xiaomi routers is a command injection vulnerability that allows attackers to execute arbitrary commands through an external interface.
How does the vulnerability in Xiaomi routers occur?
The vulnerability in Xiaomi routers occurs due to inadequate filtering of responses returned from the external interface.
How can attackers exploit the vulnerability in Xiaomi routers?
Attackers can exploit the vulnerability in Xiaomi routers by hijacking the ISP or an upper-level router and sending malicious commands through the external interface.
Is there a fix for CVE-2023-26317?
Yes, Xiaomi has released a firmware update to address the vulnerability in their routers. It is recommended to update to the latest firmware version.