Cyber Posture

CVE-2024-45356

High

Published: 27 March 2025

Published
27 March 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
EPSS Score 0.0008 23.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon specific actions by a user in order to gain execution.

Security Summary

CVE-2024-45356 is an unauthorized access vulnerability in the Xiaomi phone framework, stemming from improper validation of inputs or permissions. This flaw, classified under CWE-306 (Missing Authentication for Critical Function), enables attackers to access sensitive methods within the framework. It carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H), indicating high severity due to significant impacts on confidentiality and availability.

The vulnerability can be exploited by local attackers with no required privileges, though it demands low-complexity techniques and user interaction, such as clicking a malicious link or installing a crafted app. Successful exploitation grants high-level access to confidential data via sensitive methods, with potential for low integrity disruption and high availability impairment, such as denial-of-service effects on framework components.

For mitigation details, refer to the official advisory from Xiaomi at https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=554, which likely outlines patches or workarounds for affected devices.

Details

CWE(s)
CWE-306

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1204 User Execution Execution
An adversary may rely upon specific actions by a user in order to gain execution.
attack.mitre.org →
Why these techniques?

Missing authentication for critical functions in the phone framework enables unauthorized access to sensitive methods without privileges, directly facilitating privilege escalation (T1068), collection of confidential local data (T1005), and denial-of-service on framework components (T1499). Exploitation requires user interaction via malicious links or crafted apps (T1204).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References