CVE-2018-13022

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15

Description A cross-site scripting issue exists in the API 404 page, allowing attackers to execute arbitrary JavaScript code via a modified URL path.

Recommendations For Xiaomi Mi Router 3 version 2.22.15, consider restricting access to the API 404 page until a patch is available. As a temporary workaround, avoid using modified URL paths that could trigger the execution of arbitrary JavaScript code. At the moment, there is no information about a newer version that contains a fix for this issue.