{"cvss":0.0,"datePublished":"2025-01-02T00:00:00Z","dateUpdated":"2025-01-02T00:00:00Z","description":"An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.","dueDate":"","id":"CVE-2019-18371","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"millet_router_3g_firmware","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"mi millet_router_3g_firmware Improper Limitation of a Pathname to a Restricted Directory","vendor":"mi"}