CVE-2019-18371

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 55.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-10-23 · updated 2026-06-17
Weakness: CWE-22

Description

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.

Affected products

Millet Router 3G Firmware: before 2.28.23 — fixed in 2.28.23

How to fix

Upgrade to a fixed version: Millet Router 3G Firmware 2.28.23. Check the vendor advisory for mitigations.

References

https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py
https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py

Get alerted when CVE-2019-18371 or the next vulnerability affects your stack