CVE:CVE-2018-14010
CNNVD:CNNVD-201807-1155
Xiaomi R3P等都是中国小米公司的无线路由器产品。
多款Xiaomi产品上的/cgi-bin/luci中的访客Wi-Fi设置功能存在操作系统命令注入漏洞。攻击者可借助特制的JSON数据利用该漏洞执行任意命令。以下产品和版本受到影响：Xiaomi R3P 2.14.5之前版本；R3C 2.12.15之前版本；R3 2.22.15之前版本；R3D 2.26.4之前版本。
solution:Upgrade mi xiaomi_r3p_firmware to a higher version than 2.14.5,and avoid the version (,2.14.5); Upgrade mi xiaomi_r3c_firmware to a higher version than 2.12.15,and avoid the version (,2.12.15); Upgrade mi xiaomi_r3d_firmware to a higher version than 2.26.4,and avoid the version (,2.26.4); Upgrade mi xiaomi_r3 to a higher version than 2.22.15,and avoid the version (,2.22.15)