CVE-2018-16130

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Router 3 version 2.22.15

Description The issue allows attackers to execute arbitrary system commands via the payload variable in the request mitv function. This can be achieved by manipulating the "payload" URL parameter.

Recommendations For Xiaomi Mi Router 3 version 2.22.15, consider restricting access to the request mitv function until a patch is available. As a temporary workaround, avoid using the payload variable in the affected URL parameter to minimize the risk of exploitation.