CVE-2024-45352

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-453534.3An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper inpCVE-2024-453544.3A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and caCVE-2024-453555.5A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be explCVE-2024-453567.3A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be explCVE-2024-45365.3In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), anCVE-2024-453616.5A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed andCVE-2024-453666.1Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script maCVE-2024-453679.1The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authentiCVE-2024-453688.8The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, therCVE-2024-453698.1The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.CVE-2024-45377.5IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the downloadCVE-2024-453707.3An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A speciall
CVE-2024-45352: High severity, CVSS 8.8 | Vulnix