Author: yuspring
Published: Gist last active May 6, 2026
Source: https://gist.github.com/yuspring/37aa22bb18cb9c2a773252fb19f6b794
Summary
This GitHub Gist documents a technique for enabling root SSH access on the Xiaomi
AX3000T Wi-Fi router running stock firmware version R1.0.97 (and later builds after
1.0.90). Earlier community methods relied on the xqsystem/start_binding
flaw, which Xiaomi patched; the author shows that the unauthenticated
xqsystem/get_icon endpoint can still be abused to write and execute an
arbitrary shell script, ultimately turning on the Dropbear SSH daemon and clearing the
root password. The write-up is presented as an owner-enablement / OpenWRT-prep guide
rather than a formal vulnerability advisory, and no CVE is assigned.
Technical Details
The router’s web management API exposes the xqsystem/get_icon handler,
which the author reports can be reached without proper authentication and coerced into
writing attacker-controlled content into a predictable filesystem path under
/etc/diag_info/stat/firewall/. A small shell script is staged on the
attacker’s machine (served over a local python3 -m http.server instance),
then pulled onto the device through the get_icon request. A second request
to the upload_log API triggers execution of the staged script. The script
sets the relevant UCI/NVRAM SSH parameters, commits them, reconfigures Dropbear, starts
the service, and removes the root account password. The author does not give a detailed
explanation of the underlying parsing/path-handling defect in get_icon;
the source frames it primarily as a recipe, so the precise root cause beyond “missing
authentication and path validation on an internal endpoint” is not specified in the
article.
Impact
Successful execution yields a passwordless root SSH shell on the affected Xiaomi
AX3000T, equivalent to full control of the device — firmware modification, persistence,
traffic interception, and installation of custom firmware such as OpenWRT. Because the
abused endpoint is described as reachable without valid credentials and the procedure
removes the root password, the same primitive could in principle be misused by anyone
with network access to the router’s management interface, not only its owner. Affected:
Xiaomi AX3000T on firmware R1.0.97 and adjacent post-1.0.90 releases. The article does
not enumerate every intermediate firmware build that is or is not affected.
Mitigation
This is hobbyist enablement content and the source provides no vendor mitigation
guidance. From a defensive standpoint: keep the router’s management interface off
untrusted networks and never expose it to the WAN/Internet; apply Xiaomi firmware
updates that harden or authenticate the xqsystem/get_icon and
upload_log endpoints once available; and, on devices intentionally rooted
this way, set a strong root password rather than leaving the account passwordless.
Owners flashing OpenWRT should treat the stock firmware’s exposed internal APIs as
untrusted until reflashed.