Over 20 serious flaws that can impact both apps and system components were found by researchers in Xiaomi devices.
Although not all of the problems have been fixed, security experts informed Xiaomi of these shortcomings at the end of April 2023.
Researchers Find 20+ Critical Flaws in Xiaomi Devices Affecting Apps and System Components
The flaws could compromise user data and impact common apps used by Xiaomi userslike those for photo viewing, video viewing, and Bluetooth connectivity.
The affected Xiaomi apps include:
Four flaws in the Settings app were found, giving hackers the ability to read Bluetooth and Wi-Fi data, bind services to any app, access system files, and view Xiaomi account information, including phone numbers.
Xiaomi’s app marketplace, GetApps, has four additional vulnerabilities that could lead to memory corruption and the exposure of Xiaomi session tokens.
Xiaomi Yet to Patch Memory Corruption Flaw Reported in April 2023, Say Researchers
According to researchers, Xiaomi has not yet issued a patch for the memory corruption issue, even though it was reported in April 2023.
The memory corruption problem comes from the LiveEventBus library. Researchers said, “We informed the developer more than a year ago, but apparently, they still haven’t read our message and have not released any updates to the library.”
Users are encouraged to update their devices to the most recent versions right away as Xiaomi has fixed some of the vulnerabilities.
Researchers have identified a number of security issues with Xiaomi devices over time.
From 2014 to 2023, Xiaomi was involved in a number of security issues. Xiaomi added an opt-out option after researchers discovered in 2014 that its phones were sending user data to servers in China. Pre-installed apps were identified as possible hazards in 2016.
In 2018, it was discovered that its browsers were gathering browsing data even when in incognito mode. Privacy controls were added later. A Forbes article from 2020 claimed that Xiaomi was storing anonymised usage data on servers in Russia and Singapore.
In 2021, the U.S. briefly put Xiaomi on a military blacklist before taking it off the same year, and Lithuania issued a warning about Xiaomi devices due to censorship concerns. Researchers most recently found that Xiaomi devices sent a lot of personal information to the company and Chinese service providers in 2023.
