A severe security vulnerability has been discovered in Xiaomi’s interoperability application, potentially exposing millions of users to unauthorized device access.

The vulnerability, assigned CVE-2024-45347, carries a severe CVSS score of 9.6, indicating its high-risk nature for affected users.

Attackers can exploit this vulnerability to bypass authentication mechanisms and gain complete unauthorized access to victim devices running the affected software.

Summary
1. Xiaomi's interoperability application contains a severe vulnerability (CVE-2024-45347) that allows hackers to bypass verification logic and gain unauthorized access to victim devices.
2. The vulnerability exploits flaws in interoperability application protocols, specifically targeting the authentication mechanism and potentially compromising entire systems.
3. Version 3.1.895.10 of Xiaomi's Interconnection Application is vulnerable, while users should immediately update to the patched version 3.1.921.10.

Xiaomi App’s Authentication Bypass

The vulnerability stems from a fundamental flaw in the application’s verification logic that malicious actors can bypass.

According to Xiaomi’s security advisory, the defect lies within the interoperability application protocols, specifically in the authentication mechanism that validates user access.

This bypass vulnerability allows attackers to circumvent normal security checks and gain unauthorized access to victim devices running the affected software.

The technical nature of this vulnerability suggests that attackers could potentially exploit weaknesses in the application’s communication protocols or authentication handshake processes.

The high CVSS score of 9.6 indicates that successful exploitation could result in complete compromise of the affected system, potentially allowing attackers to access sensitive data, install malicious software, or maintain persistent access to the compromised device.

The vulnerability was discovered by Liu Xiaofeng from the School of Cyberspace Security at Shandong University, who reported the findings to Xiaomi’s Security Center (MiSRC).

Risk Factors	Details
Affected Products	Xiaomi Interconnection Application 3.1.895.10
Impact	Unauthorized access allowing attackers to gain complete access to victim’s device
Exploit Prerequisites	– Network access to target device – Knowledge of interoperability application protocols – Ability to craft malicious requests to bypass verification logic
CVSS 3.1 Score	9.6 (Critical)

Affected Versions and Security Updates

Xiaomi’s Interconnection Application version 3.1.895.10 has been identified as vulnerable to this security flaw.

Users running this specific version are at immediate risk and should update their software immediately.

Xiaomi has released a patched version 3.1.921.10 that addresses the vulnerability and restores proper verification logic functionality.

The company has not disclosed whether this vulnerability has been actively exploited in the wild, but the severity of the flaw suggests that users should prioritize updating their applications.

The interoperability application is designed to facilitate seamless connectivity between Xiaomi devices and other smart home products, making it a critical component of the company’s ecosystem.

Xiaomi continues to encourage security researchers and professionals to participate in their bug bounty program through MiSRC, emphasizing their commitment to protecting hundreds of millions of users worldwide.

The company maintains that collaborative efforts with the security community remain essential for identifying and addressing potential vulnerabilities before they can be exploited maliciously.

Are you from SOC/DFIR Teams! - Interact with malware in the sandbox and find related IOCs. - Request 14-day free trial

The post Xiaomi’s Interoperability App Vulnerability Let Hackers Gain Unauthorized Access to the Victim’s Device appeared first on Cyber Security News.