Skip to content
OpenAdvisories

Vendor

Xiaomi

27 known vulnerabilities.

Products

Xiaomi Router 4 Browser 3 GetApps application 3 Pro 13 2 Xiaomi router R3600 2 Xiaomi Mi Connect Service 2 Xiaomi phone framework 1 Galaxy FDS Android SDK 1 Game center application 1 Xiaomi shop application 1 Xiaomi Router AX9000 1 Xiaomi smarthome application 1 App Market 1 Xiaomi File Manager App International Version 1 Router AX9000 1 Xiaomi phone framework has unauthorized access vulnerability 1 quick app framework 1
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.4
    CVE-2026-26214

    Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM

    Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketF…

    Xiaomi Galaxy FDS Android SDK Android
  • High 7.3
    CVE-2024-45356

    Xiaomi phone framework has unauthorized access vulnerability

    A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.

    Xiaomi Xiaomi phone framework has unauthorized access vulnerability
  • High 8.8
    CVE-2024-45352 Public exploit

    Xiaomi smarthome application Webview has code execution vulnerability

    An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.

    Xiaomi Xiaomi smarthome application
  • High 7.8
    CVE-2024-45351

    Game center application has code execution Vulnerability

    A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.

    Xiaomi Game center application
  • High 8.8
    CVE-2023-26322

    GetApps application has code execution vulnerability

    A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

    Xiaomi GetApps application
  • High 7.6
    CVE-2023-26323

    Xiaomi App Market has a code execution vulnerability

    A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.

    Xiaomi App Market
  • High 8.8
    CVE-2023-26324

    GetApps application has code execution vulnerability

    A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

    Xiaomi GetApps application
  • High 8.8
    CVE-2024-45346

    GetApps application has code execution vulnerability

    The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same time, we also welcome more outstanding and professional security experts and security teams to join t…

    Xiaomi GetApps application
  • High 8.8
    CVE-2024-4406 Public exploit

    Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability

    Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to e…

    Xiaomi Pro 13
  • High 8.8
    CVE-2024-4405

    Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability

    Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploi…

    Xiaomi Pro 13
  • High 7.5
    CVE-2023-26320

    Xiaomi Router external request interface vulnerability leads to stack overflow

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Injection.

    Xiaomi Xiaomi Router
  • High 7.0
    CVE-2023-26317

    Xiaomi router external request interface has command injection

    Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upp…

    Xiaomi Xiaomi Router
  • High 7.5
    CVE-2019-13322

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prio…

    Xiaomi Browser
  • High 7.8
    CVE-2019-6743

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser …

    Xiaomi Browser