CVE-2019-18370

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed.

• CWE-78

• https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/remote_command_execution_vulnerability.pyExploit, Third Party Advisory
• https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/remote_command_execution_vulnerability.pyExploit, Third Party Advisory

Published

Oct 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18365In JetBrains TeamCity before 2019.1.4, reverse tabnabbing wa…4.3
• CVE-2019-18366In JetBrains TeamCity before 2019.1.2, secure values could b…5.3
• CVE-2019-18367In JetBrains TeamCity before 2019.1.2, a non-destructive ope…5.3
• CVE-2019-18368In JetBrains Toolbox App before 1.15.5666 for Windows, privi…7.3
• CVE-2019-18369In JetBrains YouTrack before 2019.2.55152, removing tags fro…5.3
• CVE-2019-1837A vulnerability in the User Data Services (UDS) API of Cisco…5.3
• CVE-2019-18371An issue was discovered on Xiaomi Mi WiFi R3G devices before…7.5
• CVE-2019-18372Symantec Endpoint Protection, prior to 14.2 RU2, may be susc…7.8
• CVE-2019-18373Norton App Lock, prior to 1.4.0.503, may be susceptible to a…5.6
• CVE-2019-18374Symantec Critical System Protection (CSP), versions 8.0, 8.0…9.8
• CVE-2019-18375The ASG and ProxySG management consoles are susceptible to a…6.5
• CVE-2019-18376A CSRF token disclosure vulnerability allows a remote attack…5.9