description: There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
problem types: command injection
affected:
{
product: Xiaomi router AX1800
vendor: n/a
versions:
status: affected, version: Xiaomi router AX1800rom version < 1.0.336
}
{
product: Xiaomi route RM1800
vendor: n/a
versions:
status: affected, version: Xiaomi route RM1800 root version < 1.0.26
}
