CVE-2023-26317

9.8 criticalEPSS 1.1%

Critical (9.8) in mi xiaomi router firmware. EPSS 1.1% chance of exploitation in the next 30 days.

Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from external interfaces. Attackers can exploit this vulnerability to gain access to the router by hijacking the ISP or upper-layer routing.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2023-08-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mi:xiaomi_router_firmware

References

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=529
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=529

Check your stack JSON