Pre-auth admin takeover on 28 Xiaomi/Redmi routers via hardcoded key
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A researcher published an unpatched disclosure for Xiaomi's mesh daemon cab_meshd, including working exploit code. A hardcoded HMAC key, identical in 28 Xiaomi and Redmi firmware images, lets a LAN or Wi-Fi client obtain admin access without a password. A separate command injection gave root on the AX3000T (RD03v2) on hardware, but Xiaomi's normal setup blocked the CAP-side routes. Runtime takeover was not tested on every model. Xiaomi had not confirmed reproduction after 45 days, so owners have no fix to apply.