Xiaoai Patch
Monthly
Unauthenticated SSRF in duhow/xiaoai-patch (all versions through commit fb07049) allows any remote attacker to force the Xiaomi XiaoAI smart speaker's API server to issue HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py blindly accepts a user-supplied url POST parameter to redirect toward a Home Assistant instance without destination validation, enabling internal network scanning and access to internal services from the speaker's network vantage point. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
OS command injection in duhow/xiaoai-patch (through commit fb07049), a community firmware-patch project for Xiaomi smart speakers, lets remote attackers run arbitrary shell commands on the device. The /mute and /unmute HTTP handlers in api/main.py pass the attacker-controlled silent query parameter straight into os.system(), so shell metacharacters break out of the intended command. Rated CVSS 9.8, but there is no public exploit identified at time of analysis and it is not on CISA KEV.
Unauthenticated SSRF in duhow/xiaoai-patch (all versions through commit fb07049) allows any remote attacker to force the Xiaomi XiaoAI smart speaker's API server to issue HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py blindly accepts a user-supplied url POST parameter to redirect toward a Home Assistant instance without destination validation, enabling internal network scanning and access to internal services from the speaker's network vantage point. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
OS command injection in duhow/xiaoai-patch (through commit fb07049), a community firmware-patch project for Xiaomi smart speakers, lets remote attackers run arbitrary shell commands on the device. The /mute and /unmute HTTP handlers in api/main.py pass the attacker-controlled silent query parameter straight into os.system(), so shell metacharacters break out of the intended command. Rated CVSS 9.8, but there is no public exploit identified at time of analysis and it is not on CISA KEV.