Notes

The skeleton key in cab_meshd

28 September 2026 · disclosure

An unauthenticated attacker on the Wi-Fi gets a root shell on the Xiaomi AX3000T (RD03v2). One hard-coded, firmware-global key in the mesh daemon cab_meshd is shared byte-for-byte across 28 Xiaomi and Redmi models. Unpatched.