VulnerabilityDeferred

CVE-2024-45347

An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP.

CRITICAL 9.6EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.

CVSS 3.1: 9.6 CRITICALCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-287
Source: security@xiaomi.com

References

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=548

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.