CVE-2018-16307: mi xiaomi_miwifi_xiaomi_55dd_firmware

Vulnerability summary

CVE-2018-16307 is a high (CVSS 7.5) vulnerability in mi xiaomi_miwifi_xiaomi_55dd_firmware. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.