CVE-2023-26315: The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an…

PriorityP273high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

18.64%

96.9th percentile

The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mi	ax9000_firmware	>= 1.0.0 < 1.0.174	1.0.174
xiaomi	router_ax9000	1.0.0 – 1.0.168	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.