Sign-up

ID

VAR-201807-0387


CVE

CVE-2018-14010


TITLE

plural Xiaomi In product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-008091

DESCRIPTION

OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data. plural Xiaomi The product includes OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Xiaomi routers R3D / R3P / R3C / R3 are all router products. There is a remote arbitrary command execution vulnerability in the wi-fi setting function of several Xiaomi routers. An attacker could use this vulnerability to execute arbitrary code remotely

Trust: 2.25

sources: NVD: CVE-2018-14010 // JVNDB: JVNDB-2018-008091 // CNVD: CNVD-2018-04521 // VULMON: CVE-2018-14010

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

category:['network device']sub_category:router

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2018-04521

AFFECTED PRODUCTS

vendor:mimodel:xiaomi r3pscope:ltversion:2.14.5

Trust: 1.0

vendor:mimodel:xiaomi r3cscope:ltversion:2.12.15

Trust: 1.0

vendor:mimodel:xiaomi r3scope:ltversion:2.22.15

Trust: 1.0

vendor:mimodel:xiaomi r3dscope:ltversion:2.26.4

Trust: 1.0

vendor:xiaomimodel:r3scope:ltversion:2.22.15

Trust: 0.8

vendor:xiaomimodel:r3cscope:ltversion:2.12.15

Trust: 0.8

vendor:xiaomimodel:r3dscope:ltversion:2.26.4

Trust: 0.8

vendor:xiaomimodel:r3pscope:ltversion:2.14.5

Trust: 0.8

vendor: - model:xiaomi technology co. ltd.xiaomi router r3scope:ltversion:2.22.15

Trust: 0.6

vendor: - model:xiaomi technology co. ltd.xiaomi router r3cscope:ltversion:2.12.15

Trust: 0.6

vendor:xiaomimodel:router r3dscope:ltversion:2.26.4

Trust: 0.6

vendor:xiaomimodel:router r3pscope:ltversion:2.14.5

Trust: 0.6

sources: CNVD: CNVD-2018-04521 // JVNDB: JVNDB-2018-008091 // NVD: CVE-2018-14010

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-14010
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-14010
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-04521
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201807-1155
value: CRITICAL

Trust: 0.6

VULMON: CVE-2018-14010
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-14010
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-04521
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-14010
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-04521 // VULMON: CVE-2018-14010 // JVNDB: JVNDB-2018-008091 // CNNVD: CNNVD-201807-1155 // NVD: CVE-2018-14010

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2018-008091 // NVD: CVE-2018-14010

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1155

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201807-1155

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-008091

PATCH
title:Top Pageurl:https://www.mi.com/en/index.html
Trust: 0.8
title:A remote arbitrary command execution vulnerability exists in several Xiaomi smart routersurl:https://www.cnvd.org.cn/patchInfo/show/120311
Trust: 0.6
title:Multiple Xiaomi Product operating system command injection vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84055
Trust: 0.6
title:routerurl:https://github.com/cc-crack/router 
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-04521 // 
            
            
            
            VULMON: CVE-2018-14010 // 
            
            
            
            JVNDB: JVNDB-2018-008091 // 
            
            
            
            CNNVD: CNNVD-201807-1155

EXTERNAL IDS
db:NVDid:CVE-2018-14010
Trust: 3.2
db:CNVDid:CNVD-2018-04521
Trust: 3.1
db:JVNDBid:JVNDB-2018-008091
Trust: 0.8
db:CNNVDid:CNNVD-201807-1155
Trust: 0.6
db:OTHERid:NONE
Trust: 0.1
db:VULMONid:CVE-2018-14010
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2018-04521 // 
            
            
            
            VULMON: CVE-2018-14010 // 
            
            
            
            JVNDB: JVNDB-2018-008091 // 
            
            
            
            CNNVD: CNNVD-201807-1155 // 
            
            
            
            NVD: CVE-2018-14010

REFERENCES
url:https://github.com/cc-crack/router/blob/master/cnvd-2018-04521.py
Trust: 2.5
url:http://www.cnvd.org.cn/flaw/show/cnvd-2018-04521
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14010
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-14010
Trust: 0.8
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/cc-crack/router
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            VULMON: CVE-2018-14010 // 
            
            
            
            JVNDB: JVNDB-2018-008091 // 
            
            
            
            CNNVD: CNNVD-201807-1155 // 
            
            
            
            NVD: CVE-2018-14010

SOURCES
db:OTHERid: - 
db:CNVDid:CNVD-2018-04521
db:VULMONid:CVE-2018-14010
db:JVNDBid:JVNDB-2018-008091
db:CNNVDid:CNNVD-201807-1155
db:NVDid:CVE-2018-14010

LAST UPDATE DATE
2025-01-30T19:29:55.434000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-04521date:2018-03-12T00:00:00
db:VULMONid:CVE-2018-14010date:2018-09-12T00:00:00
db:JVNDBid:JVNDB-2018-008091date:2018-10-09T00:00:00
db:CNNVDid:CNNVD-201807-1155date:2018-08-13T00:00:00
db:NVDid:CVE-2018-14010date:2024-11-21T03:48:26.510

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-04521date:2018-04-23T00:00:00
db:VULMONid:CVE-2018-14010date:2018-07-15T00:00:00
db:JVNDBid:JVNDB-2018-008091date:2018-10-09T00:00:00
db:CNNVDid:CNNVD-201807-1155date:2018-07-14T00:00:00
db:NVDid:CVE-2018-14010date:2018-07-15T03:29:00.227