Medium severity · published Mar 27, 2025
CVE-2024-45361
Mi Connect Service APP protocol flaws lead to leaking sensitive user information
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XM
Xiaomi Mi Connect Service · Xiaomi
Xiaomi Mi Connect Service3.1.895.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45361
trust.mi.com
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=558
More from Xiaomi Mi Connect Service
9.6
CVE-2024-45347
Mi Connect Service APP protocol flaws lead to unauthorized access