by Kastro
Paper/Archive/CVE-2024-45347

CVE-2024-45347

Xiaomi Xiaomi Mi Connect Service — Mi Connect Service APP protocol flaws lead to unauthorized access

EPSS 0.3%CVSS 9.6
critical.is priorityof 100
33
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 20.3.203 × 204.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.

Affected

ProductAffectedFixed inSource
Xiaomi Mi Connect ServiceXiaomi Mi Connect Service3.1.895.10–CNA

Scores by source

Xiaomi (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftrust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=548