Xiaomi Router unauthorized access vulnerability

Vulnerability Information Reference report details on the cloud

The local tests are as follows:

Connect Xiaomi's WiFi login admin background page has a password box

Wireshark Capture package found the default transfer username is admin

Save Wireshark caught packet to filter out HTTP messages

Find the following:

Xiaomi Smart Router token parameter to determine the current user status of timeliness

But the token parameter expires too long that you can log in to the backend management system as long as you can get the parameter

Send the connection to your colleague's test and log in successfully.

Xiaomi Router unauthorized access vulnerability