A critical OS command injection vulnerability in the duhow xiaoai-patch allows unauthenticated remote attackers to execute arbitrary system commands on affected Xiaomi smart speakers.

The application fails to sanitize user-supplied input in the silent query parameter before passing it to the system shell. This allows an unauthenticated attacker to inject malicious commands directly into the underlying operating system.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for full system compromise. Successful exploitation grants an attacker complete control over the affected smart speaker, which could lead to unauthorized network access, data interception, or the use of the device as a pivot point for further lateral movement within the local network.

Immediate Action: Update the duhow xiaoai-patch to the latest available version that includes sanitization for the /mute and /unmute endpoints.

Proactive Monitoring: Monitor device traffic and system logs for unusual command execution patterns or unauthorized attempts to access the /mute or /unmute endpoints.

Compensating Controls: Implement network segmentation to isolate smart speakers from sensitive internal resources and deploy a firewall to restrict access to the affected service endpoints.

Public Exploit Available: Unknown

Given the critical severity and the ease of exploitation, immediate action is required. Organizations should prioritize updating the software to a patched version to prevent potential remote code execution and subsequent device takeover.