CyberRota Analysis
AI-GeneratedXiaomi smart speakers utilizing the duhow/xiaoai-patch are vulnerable to an OS command injection flaw that allows remote attackers to execute arbitrary system commands through unsanitized user input in the /mute and /unmute endpoint handlers. This critical vulnerability, with a CVSS score of 9.8, poses significant risks to device integrity and user privacy. Organizations using these devices should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.