Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv3

CVE-2019-18371

Published: 23/10/2019 Updated: 29/10/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Mi

Vulnerability Summary

An issue exists on Xiaomi Mi WiFi R3G devices prior to 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

mi millet_router_3g_firmware

Github Repositories

https://github.com/UltramanGaia/POC-EXP

POC-EXP 漏洞 备注 Drupal Drupalgeddon 2 远程代码执行漏洞（CVE-2018-7600） 复现分析 小米系列路由器漏洞（CVE-2019-18371/CVE-2019-18370） 漏洞报告

References

CWE-22https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.pyhttps://nvd.nist.govhttps://github.com/UltramanGaia/POC-EXP
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook