NOW YOU SEE MI: NOW YOU'RE PWNED

Summary from the TLDR InfoSec newsletter

TASZK Security Labs' research on the Xiaomi C400 smart camera uncovers three vulnerabilities in the proprietary miIO setup protocol: an authentication bypass in the handshake, a cryptographically weak PRNG, and a heap buffer overflow leading to controlled heap metadata corruption and reliable RCE over Wi‑Fi. By exploiting protocol design flaws and allocator behavior, an attacker in radio range can first win the setup race or abuse a factory reset, then pivot from packet parsing to full root access, implant a persistent “cloud jailbreak,” and reroute video/control through self‑hosted infrastructure while firewalling Xiaomi's cloud.