Xiaomi Mi Wifi - Path Traversal (CVE-2019-18371)

CVE-2019-18371 is a vulnerability affecting Xiaomi Mi WiFi devices, allowing attackers to read arbitrary files through a directory traversal flaw. This occurs due to a misconfigured NGINX alias, potentially enabling remote bypass of authentication and access to sensitive configuration files.

CrowdSec has been tracking this vulnerability and its exploits since 29th of January 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2019-18371 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2019-18371 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2019-18371 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts typically involve requests to URLs containing /api-third-party/download/extdisks../.