CVE-2024-45352
Published: 27 March 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2024-45352 is a code execution vulnerability in the Xiaomi smarthome application product. The issue stems from improper input validation, enabling attackers to execute malicious code. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-346. The vulnerability was published on 2025-03-27.
Attackers can exploit this vulnerability remotely over the network with low complexity and no privileges required, though user interaction is necessary. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary code execution on the affected device.
For mitigation details, refer to the advisory at https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=550.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a remote code execution flaw in a client application (Xiaomi smarthome) due to improper input validation, directly enabling Exploitation for Client Execution (T1203) with user interaction required.