Xiaomi
28 CVEs across 18 Xiaomi products. Browse Xiaomi vulnerabilities, severities, and proof-of-concept exploits.
Xiaomi products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-29515 | Critical | 9.8 | 2026-03-11 | MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without… |
CVE-2024-45347 | Critical | 9.6 | 2025-06-23 | An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be expl… |
CVE-2024-45361 | Medium | 6.5 | 2025-03-27 | A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited b… |
CVE-2024-45356 | High | 7.3 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45355 | Medium | 5.5 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45354 | Medium | 4.3 | 2025-03-27 | A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by a… |
CVE-2024-45353 | Medium | 4.3 | 2025-03-27 | An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and c… |
CVE-2024-45352 | High | 8.8 | 2025-03-27 | An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploit… |
CVE-2024-45351 | High | 7.8 | 2025-03-26 | A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be explo… |
CVE-2024-45348 | Medium | 6.4 | 2024-09-23 | Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an att… |
CVE-2023-26324 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26323 | High | 7.6 | 2024-08-28 | A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers t… |
CVE-2023-26322 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26321 | Medium | 6.3 | 2024-08-28 | A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special… |
CVE-2024-45346 | High | 8.8 | 2024-08-28 | The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same t… |
CVE-2023-26315 | Medium | 6.5 | 2024-08-26 | The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an at… |
CVE-2024-4406 | Critical | 9.6 | 2024-05-02 | Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-4405 | Critical | 9.6 | 2024-05-02 | Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-26320 | High | 7.5 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26319 | Medium | 6.7 | 2023-10-11 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. |
CVE-2023-26318 | Medium | 6.7 | 2023-10-11 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers. |
CVE-2023-26317 | High | 7.0 | 2023-08-02 | Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interface… |
CVE-2020-14095 | Critical | 9.8 | 2020-06-24 | In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or… |
CVE-2020-14094 | Critical | 9.8 | 2020-06-24 | In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execut… |
CVE-2019-13322 | High | 8.8 | 2020-02-10 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is require… |
CVE-2019-13321 | High | 8.0 | 2020-02-10 | This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is… |
CVE-2019-6743 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is req… |
CVE-2011-4697 | | 2012-01-25 | The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read o… |