Paper/Archive/CVE-2023-26323

CVE-2023-26323

Xiaomi App Market — Xiaomi App Market has a code execution vulnerability

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.8.478 × 209.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.

Affected

ProductAffectedFixed inSource

App Market1.0.0 – 4.57.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Xiaomi (CNA)7.6CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reftrust.mi.com/misrc/bulletins/advisory?cveId=543