CVE-2018-14060

OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
mixiaomi_r3d_firmware
𝑥
< 2.26.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520
https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.py
http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520
https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.py