CVE-2024-45348

Xiaomi Router AX9000 has a post-authorization command injection vulnerability

State: Published
Severity: 6.4 Medium
Published: Sep 23, 2024
Updated: Mar 27, 2025
Reserved: Aug 28, 2024

Description

Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H	Xiaomi

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Xiaomi Router AX9000Xiaomi	1.0.173Affected

References

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=547

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.