CVE-2023-26315
Published: 26 August 2024
Summary
CVE-2023-26315 is a medium-severity OS Command Injection (CWE-78) vulnerability in Mi Ax9000 Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Xiaomi router AX9000 contains a post-authentication command injection vulnerability tracked as CVE-2023-26315. The flaw stems from missing input filtering and is classified under CWE-78 and CWE-77. It affects the device firmware and carries a CVSS 3.1 score of 6.5 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
An attacker who has already obtained administrative credentials can supply crafted input over the network to execute arbitrary commands. Successful exploitation grants root-level access to the router, enabling full control over device configuration and traffic.
Xiaomi has published an advisory that addresses the issue at https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=546. The current EPSS score of 0.6750 has remained flat at its recorded peak, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30136
Vulnerability details
The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.