Mi Xiaomi r3d Firmware vulnerabilities

2 CVEs affecting Mi Xiaomi r3d Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-14060, published 2018-07-15.

More from Mi.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-14060, published 2018-07-15. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON…
• CVE-2018-14010, published 2018-07-15. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to…