CVE-2024-45348

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of user input, and an attacker can exploit this vulnerability to execute arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-45358.8The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logg CVE-2024-453517.8A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validati CVE-2024-453528.8An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation CVE-2024-453534.3An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper inp CVE-2024-453544.3A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and ca CVE-2024-453555.5A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be expl CVE-2024-453567.3A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be expl CVE-2024-45365.3In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an CVE-2024-453616.5A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and CVE-2024-453666.1Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script ma CVE-2024-453679.1The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenti CVE-2024-453688.8The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, ther