CVE-2019-18371

CVE-2019-18371 is a directory traversal vulnerability affecting Xiaomi Mi WiFi R3G devices running firmware versions prior to 2.28.23-stable. This flaw allows an unauthenticated attacker to read arbitrary files on the device by exploiting a misconfigured NGINX alias, effectively bypassing authentication. With a CVSS score of 7.5 (High), the vulnerability is easily exploitable over the network with low attack complexity, leading to a high impact on confidentiality. While there is no evidence of active exploitation in the wild or Metasploit modules, Nuclei templates exist for detecting this high-severity local file inclusion, and its EPSS score indicates a high probability of exploitation.