https://vulnogram.org/ Most recent CVEs assigned by Xiaomi Technology Co., Ltd. (xiaomi). https://vulnogram.org/seaview/icons/xiaomi.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2024-45347 https://vulnogram.org/CVE-2024-45347 An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device. Critical Mon, 23 Jun 2025 09:34:38 GMT https://vulnogram.org/CVE-2024-45361 https://vulnogram.org/CVE-2024-45361 A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information. Medium Thu, 27 Mar 2025 07:16:21 GMT https://vulnogram.org/CVE-2024-45356 https://vulnogram.org/CVE-2024-45356 A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods. High Thu, 27 Mar 2025 07:11:41 GMT https://vulnogram.org/CVE-2024-45355 https://vulnogram.org/CVE-2024-45355 A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods. Medium Thu, 27 Mar 2025 06:48:07 GMT https://vulnogram.org/CVE-2024-45354 https://vulnogram.org/CVE-2024-45354 A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. Medium Network Exploitable Thu, 27 Mar 2025 06:25:56 GMT https://vulnogram.org/CVE-2024-45353 https://vulnogram.org/CVE-2024-45353 An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction. Medium Network Exploitable Thu, 27 Mar 2025 06:12:57 GMT https://vulnogram.org/CVE-2024-45352 https://vulnogram.org/CVE-2024-45352 An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. High Network Exploitable Thu, 27 Mar 2025 02:02:34 GMT https://vulnogram.org/CVE-2024-45351 https://vulnogram.org/CVE-2024-45351 A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code. High Wed, 26 Mar 2025 13:17:07 GMT https://vulnogram.org/CVE-2024-45348 https://vulnogram.org/CVE-2024-45348 Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code. Medium Mon, 23 Sep 2024 08:25:47 GMT https://vulnogram.org/CVE-2023-26322 https://vulnogram.org/CVE-2023-26322 A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code. High Network Exploitable Wed, 28 Aug 2024 07:59:26 GMT https://vulnogram.org/CVE-2023-26323 https://vulnogram.org/CVE-2023-26323 A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code. High Wed, 28 Aug 2024 07:53:42 GMT https://vulnogram.org/CVE-2023-26321 https://vulnogram.org/CVE-2023-26321 A path traversal vulnerability exists in the Xiaomi File Manager application product(international version). The vulnerability is caused by unfiltered special characters and can be exploited by attackers to overwrite and execute code in the file. Medium Wed, 28 Aug 2024 07:51:28 GMT https://vulnogram.org/CVE-2023-26324 https://vulnogram.org/CVE-2023-26324 A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code. High Network Exploitable Wed, 28 Aug 2024 07:28:35 GMT https://vulnogram.org/CVE-2024-45346 https://vulnogram.org/CVE-2024-45346 The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams… High Network Exploitable Wed, 28 Aug 2024 06:44:40 GMT https://vulnogram.org/CVE-2023-26315 https://vulnogram.org/CVE-2023-26315 The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device. Medium Mon, 26 Aug 2024 11:47:17 GMT https://vulnogram.org/CVE-2023-26320 https://vulnogram.org/CVE-2023-26320 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. High Wed, 11 Oct 2023 06:49:50 GMT https://vulnogram.org/CVE-2023-26319 https://vulnogram.org/CVE-2023-26319 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection. Medium Wed, 11 Oct 2023 06:45:07 GMT https://vulnogram.org/CVE-2023-26318 https://vulnogram.org/CVE-2023-26318 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers. Medium Wed, 11 Oct 2023 06:42:16 GMT https://vulnogram.org/CVE-2023-26317 https://vulnogram.org/CVE-2023-26317 Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the I… High Network Exploitable Wed, 02 Aug 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-26316 https://vulnogram.org/CVE-2023-26316 A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service… Wed, 02 Aug 2023 00:00:00 GMT https://vulnogram.org/CVE-2020-14140 https://vulnogram.org/CVE-2020-14140 When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulner… High Network Exploitable Wed, 29 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2020-14131 https://vulnogram.org/CVE-2020-14131 The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe ac… Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2020-14129 https://vulnogram.org/CVE-2020-14129 A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege. Tue, 11 Oct 2022 00:00:00 GMT https://vulnogram.org/CVE-2020-14114 https://vulnogram.org/CVE-2020-14114 information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information. Fri, 22 Jul 2022 15:32:00 GMT https://vulnogram.org/CVE-2020-14126 https://vulnogram.org/CVE-2020-14126 Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information. Fri, 22 Jul 2022 15:30:39 GMT https://vulnogram.org/CVE-2020-14127 https://vulnogram.org/CVE-2020-14127 A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service. Thu, 14 Jul 2022 14:46:49 GMT https://vulnogram.org/CVE-2020-14125 https://vulnogram.org/CVE-2020-14125 A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service. Wed, 08 Jun 2022 14:14:57 GMT https://vulnogram.org/CVE-2020-14123 https://vulnogram.org/CVE-2020-14123 There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulti… Fri, 22 Apr 2022 15:17:36 GMT https://vulnogram.org/CVE-2020-14117 https://vulnogram.org/CVE-2020-14117 A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permission verification in the Xiaomi content center APP, and attackers can use this vulnerability to invoke the sensi… Thu, 21 Apr 2022 17:40:02 GMT https://vulnogram.org/CVE-2020-14118 https://vulnogram.org/CVE-2020-14118 An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming data, can cause the app store to automatically download and install apps. Thu, 21 Apr 2022 17:33:02 GMT https://vulnogram.org/CVE-2020-14120 https://vulnogram.org/CVE-2020-14120 Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vu… Thu, 21 Apr 2022 17:30:37 GMT https://vulnogram.org/CVE-2020-14122 https://vulnogram.org/CVE-2020-14122 Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage. Thu, 21 Apr 2022 17:27:52 GMT https://vulnogram.org/CVE-2020-14121 https://vulnogram.org/CVE-2020-14121 A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation. Thu, 21 Apr 2022 17:25:10 GMT https://vulnogram.org/CVE-2020-14116 https://vulnogram.org/CVE-2020-14116 An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity of the incoming data. Attackers can perform sensitive operations by exploiting this. Thu, 21 Apr 2022 17:22:21 GMT https://vulnogram.org/CVE-2020-14115 https://vulnogram.org/CVE-2020-14115 A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code. Mon, 07 Mar 2022 15:33:20 GMT https://vulnogram.org/CVE-2020-14111 https://vulnogram.org/CVE-2020-14111 A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code. Mon, 07 Mar 2022 15:24:50 GMT https://vulnogram.org/CVE-2020-14112 https://vulnogram.org/CVE-2020-14112 Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000. Mon, 07 Mar 2022 14:06:49 GMT https://vulnogram.org/CVE-2020-14107 https://vulnogram.org/CVE-2020-14107 A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN. Tue, 18 Jan 2022 16:52:15 GMT https://vulnogram.org/CVE-2020-14110 https://vulnogram.org/CVE-2020-14110 AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background. Tue, 18 Jan 2022 16:51:43 GMT https://vulnogram.org/CVE-2020-14124 https://vulnogram.org/CVE-2020-14124 There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12. Thu, 16 Sep 2021 12:08:45 GMT https://vulnogram.org/CVE-2020-14119 https://vulnogram.org/CVE-2020-14119 There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom< 1.1.12 Thu, 16 Sep 2021 12:03:05 GMT https://vulnogram.org/CVE-2020-14109 https://vulnogram.org/CVE-2020-14109 There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12 Thu, 16 Sep 2021 11:55:33 GMT https://vulnogram.org/CVE-2020-14130 https://vulnogram.org/CVE-2020-14130 Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809 Thu, 16 Sep 2021 11:41:50 GMT https://vulnogram.org/CVE-2020-14105 https://vulnogram.org/CVE-2020-14105 The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. Tue, 20 Apr 2021 15:49:21 GMT https://vulnogram.org/CVE-2020-14106 https://vulnogram.org/CVE-2020-14106 The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26. Thu, 08 Apr 2021 20:57:52 GMT https://vulnogram.org/CVE-2020-14103 https://vulnogram.org/CVE-2020-14103 The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. Thu, 08 Apr 2021 20:23:25 GMT https://vulnogram.org/CVE-2020-14099 https://vulnogram.org/CVE-2020-14099 On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password. Thu, 08 Apr 2021 17:52:45 GMT https://vulnogram.org/CVE-2020-14104 https://vulnogram.org/CVE-2020-14104 A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50. Thu, 08 Apr 2021 17:44:10 GMT https://vulnogram.org/CVE-2020-14102 https://vulnogram.org/CVE-2020-14102 There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26. Wed, 13 Jan 2021 22:33:05 GMT https://vulnogram.org/CVE-2020-14098 https://vulnogram.org/CVE-2020-14098 The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26. Wed, 13 Jan 2021 22:30:41 GMT