important · Firmware / Wi-Fi
A main-network peer can take over Xiaomi AX3000T administration; factory-state mesh setup adds a root path.
Affects
Xiaomi Router AX3000T, a consumer Wi-Fi 6 mesh router running MiWiFi/XiaoQiang firmware.
The firmware-global mesh key authenticates an arbitrary peer to cab_meshd, which discloses enough material to derive a valid administrator login response.
Detail and 3 sources
On a factory-reset RD03v2, malicious mesh initialization fields are evaluated by a root shell.
Public code and hardware testing validate the administrator takeover and uid-0 execution paths.
Sources
ResearchAll Specs, Features of Xiaomi Router AX3000T | XiaomiCode / PoCGitHub - ADCDS/xiaomi-ax3000t-cabmeshd-disclosure: Coordinated disclosure to Xiaomi: two pre-auth compromise chains in AX3000T (RD03v2) cab_meshd · GitHubCode / PoCxiaomi-ax3000t-cabmeshd-disclosure/ADVISORY.md at master · ADCDS/xiaomi-ax3000t-cabmeshd-disclosure · GitHub