CVE-2024-4405 is a cross site scripting flaw in the manual-upgrade page of the Xiaomi 13 Pro app store that can lead to code execution. NVD scores it Critical (9.6), while the Zero Day Initiative lists 8.8. Per ZDI, Xiaomi said GetApps 32.0.0.1 addressed it.
What's affected
- Product: Xiaomi 13 Pro, firmware 14.0.5.0 in the CPE entry, and the GetApps (mimarket) application.
- Affected page: manual-upgrade.html, through the manualUpgradeInfo parameter.
- Fixed version: ZDI says Xiaomi stated that GetApps 32.0.0.1 addressed the issue. I could not find a Xiaomi advisory to confirm it, so treat it as ZDI's report of the vendor's statement.
- Severity conflict: NVD gives CVSS 9.6, Critical, with a changed scope. ZDI's advisory lists 8.8, High. I use the NVD figure in the title and name both here.
- ZDI also notes that this came from Pwn2Own, and that Xiaomi said it would assign a CVE but did not follow through. The CVE here is not from Xiaomi.
- Exploitation: KEV is false.
How to check if you're exposed
On the phone, open the GetApps app store, go to its settings or about page and read the version. Anything below 32.0.0.1 is the range ZDI describes. Then check your system update status for any firmware update.
For a managed fleet, collect the GetApps version from your mobile device management tool if it reports installed app versions.
What to do now
- Update GetApps through the app store and confirm it reads 32.0.0.1 or higher.
- Install any pending system update for the device.
- Be careful with links and files opened on the phone until the update is in place, because the record says user interaction is required.
- For company devices, use your device management tool to list GetApps versions.
- Check Xiaomi's security pages for a statement on this issue, as I could not find one.
Why it matters
The record maps this to CWE-79, cross site scripting. The page reads a parameter and writes it into its content without sanitizing it, so injected script runs in the app's web view.
In a normal website, XSS steals sessions. In an app's embedded web view, the script may reach app features that a normal page cannot. That is why this one rates near the top of the scale, and why the record frames it as code execution.
Quick check
Why do NVD and ZDI show different scores?
NVD lists 9.6 with a changed scope. ZDI lists 8.8 for the same issue. Scoring teams sometimes disagree on scope.
Which version fixes it?
ZDI says Xiaomi stated GetApps 32.0.0.1 addressed it. I could not confirm that with a Xiaomi page.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4405 (published 2024-05-02) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
