CVE-2018-20523: mi redmi_4a_firmware Command Injection
Vulnerability summary
CVE-2018-20523 is a medium (CVSS 5.3) Command Injection vulnerability in mi redmi_4a_firmware. EPSS estimates a 10.01% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 07-06-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
10.01%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.01% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (vishwarajbhattrai.wordpress.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Xiaomi browser 10.2.4.g - Browser Search History Disclosure
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Mi19 products
1 vendor · 19 products
References
3 links- vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browserX Refsource MISCExploitThird Party Advisory
- packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry