Critical severity · published Jun 23, 2025
CVE-2024-45347
Mi Connect Service APP protocol flaws lead to unauthorized access
9.6
CVSS
0.3%
EPSS
No
On KEV
Description
An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XM
Xiaomi Mi Connect Service · Xiaomi
Xiaomi Mi Connect Service3.1.895.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45347
trust.mi.com
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=548
More from Xiaomi Mi Connect Service
6.5
CVE-2024-45361
Mi Connect Service APP protocol flaws lead to leaking sensitive user information