by Kastro
Paper/Archive/CVE-2023-26324

CVE-2023-26324

Xiaomi GetApps application — GetApps application has code execution vulnerability

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.6.506 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

Affected

ProductAffectedFixed inSource
GetApps applicationGetApps application – 30.6.0.2–CNA
getapps_application≤ 30.6.0.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Xiaomi (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refhttps://trust.mi.com/misrc/bulletins/advisory?cveId=544