CVE-2024-4406 is a cross site scripting flaw in the integral-dialog-page of GetApps on the Xiaomi 13 Pro, rated Critical (9.6) by NVD and 8.8 by the Zero Day Initiative. Per ZDI, Xiaomi said GetApps 32.0.0.1 addressed it. The sibling record is CVE-2024-4405.
What's affected
- Product: Xiaomi 13 Pro, firmware 14.0.5.0 in the CPE entry, and the GetApps application.
- Affected page: integral-dialog-page.html, through the integralInfo parameter.
- Fixed version: ZDI's advisory says Xiaomi stated GetApps 32.0.0.1 addressed ZDI-CAN-22332. I could not confirm that from a Xiaomi page.
- Severity conflict: NVD scores 9.6, Critical. ZDI's advisory lists 8.8, High, both with network vector and user interaction required.
- ZDI notes that Xiaomi told it a CVE would be assigned but never followed through, so the CVE comes from another party.
- Exploitation: KEV is false.
How to check if you're exposed
Open GetApps and read the version number on its about page. Below 32.0.0.1 is the range ZDI describes. Check the system update screen too.
This is a different page and parameter from CVE-2024-4405, so a fix for one is not proof of a fix for the other. ZDI's text says the same GetApps version addressed each, so confirm both on the same build.
What to do now
- Update GetApps and confirm version 32.0.0.1 or higher.
- Apply pending system updates to the handset.
- Avoid opening unknown links or files on the device until updated.
- For fleets, report GetApps versions through device management.
- Look for a Xiaomi security bulletin and keep its link with your records.
Why it matters
The record maps this to CWE-79. The integral dialog page takes a value from the request and puts it into the page unescaped. A crafted value turns into script.
Two pages in the same app with the same flaw suggest the underlying problem is how the app handles parameters generally, not one slip. Reviewers of mobile apps that wrap web content should test every page that accepts parameters.
Quick check
How does this differ from CVE-2024-4405?
Different page and parameter in the same app: integral-dialog-page and integralInfo, versus manual-upgrade and manualUpgradeInfo.
Does it need user interaction?
Yes. The target must visit a malicious page or open a malicious file, per the description.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4406 (published 2024-05-02) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
