CVE-2024-45351
Published: 26 March 2025
Summary
CVE-2024-45351 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Mi (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces proper validation of information inputs to prevent exploitation of improper input validation leading to code execution in the Xiaomi Game Center application.
Requires identification, reporting, and timely patching of the specific flaw in input validation causing arbitrary code execution.
Implements memory safeguards such as DEP and ASLR to block unauthorized code execution even if invalid inputs bypass application validation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables arbitrary code execution in a client application (Xiaomi Game Center) via improper input validation requiring user interaction, directly mapping to T1203 Exploitation for Client Execution.
NVD Description
A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
Deeper analysisAI
CVE-2024-45351 is a code execution vulnerability in the Xiaomi Game Center application. The issue stems from improper input validation (CWE-1284), enabling attackers to execute malicious code. It was published on 2025-03-26 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction is necessary (UI:R). An attacker could exploit it by tricking a user into interacting with malicious input via the affected application, leading to arbitrary code execution with high-impact consequences on the local system.
Mitigation details are available in the Xiaomi security advisory at https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=549.
Details
- CWE(s)