RCE in Mi Millet Router 3g
CVE-2019-18370
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.403 (98.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.403 · newest: 0.403 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/remote… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-18370?
- CVE-2019-18370 is a critical-severity vulnerability in Mi Millet Router 3g, classified under OS Command Injection. CVSS score: 9.8/10. Published 2019-10-23.
- How severe is CVE-2019-18370?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-18370 known to be exploited?
- 42 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.