CVE-2019-18371: Mi Millet Router 3g Firmware

High severity, CVSS 7.5. EPSS: 55.9% chance of exploitation in the next 30 days.

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.

Affected products

• Mi Millet Router 3g Firmware: before 2.28.23 (fixed in 2.28.23)

Published 2019-10-23. Last modified 2026-06-17.