CVE-2024-45348
CVE-2024-45348 is a post-authorization command injection vulnerability affecting the Xiaomi Router AX9000. This vulnerability allows attackers to execute arbitrary code due to insufficient validation of user input after authentication. While the CVSS score is 6.4, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a relatively lower level of immediate threat compared to critical vulnerabilities. An attacker who has already gained authorized access to the router's management interface can leverage this flaw to inject and execute malicious commands. This can lead to complete system compromise, potentially enabling data theft, denial of service, or use of the router as part of a botnet. Even with the low SVRS, users should still apply available patches or mitigations to prevent exploitation, as the risk could escalate if this is combined with other vulnerabilities or if exploit code becomes widely available. Failure to address CVE-2024-45348 could expose networks to significant risks, highlighting the importance of security updates.
Description
CVE-2024-45348 is a post-authorization command injection vulnerability in Xiaomi Router AX9000. This vulnerability arises due to insufficient validation of user input, allowing attackers to execute arbitrary code. The SVRS of 46 indicates a moderate risk, highlighting the need for attention and appropriate mitigation measures.
Key Insights
- Exploitation: Active exploits have been published, indicating that attackers are actively exploiting this vulnerability.
- Impact: Successful exploitation could allow attackers to execute arbitrary code on the affected router, potentially leading to remote code execution, data theft, or denial of service.
- Affected Devices: Xiaomi Router AX9000 is the only known affected device.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, urging organizations to take immediate action to mitigate this vulnerability.
Mitigation Strategies
- Apply Software Updates: Install the latest firmware update from Xiaomi to patch the vulnerability.
- Disable Remote Management: If possible, disable remote management features on the router to reduce the attack surface.
- Use Strong Passwords: Set strong and unique passwords for the router's administrative interface.
- Enable Firewall: Configure a firewall to block unauthorized access to the router's management ports.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- In the Wild: The vulnerability is actively exploited by hackers.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.