CVE-2019-18371
CVE-2019-18371
Vexday Risk Score
72High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 55.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
30 Aug 2019Public PoC
23 Oct 2019Published on NVD
Recommendation: Patch as soon as possible — active exploitation confirmed.
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
Affected products
n/a · n/apublic PoCs found — 1
vulncheckvulncheck.com/xdb/750ba4d5e0baunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.