PT-2020-4298 · Xiaomi · Xiaomi R3600

Published 2020-09-11 · Updated 2021-07-21 · CVE-2020-14100

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Xiaomi R3600 ROM version prior to 1.0.66

Description: The issue is related to insufficient input validation in the set WAN6 interface of the Xiaomi R3600 router's firmware, allowing filters to be bypassed. This can lead to remote code execution, enabling an attacker to gain root access to the router. An attacker can exploit this issue by sending specially crafted network packets to the targeted system.

Recommendations: For versions prior to 1.0.66, update to version 1.0.66 or later to resolve the issue. As a temporary workaround, consider restricting access to the set WAN6 interface until a patch is available.

Fix

Command Injection

Improper Privilege Management

Weakness Enumeration

CWE-77

CWE-269

Related Identifiers

BDU:2020-04791

CVE-2020-14100

Affected Products

Xiaomi R3600

References · 5

• https://bdu.fstec.ru/vul/2020-04791 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14100 · Security Note
• https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=20&locale=en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14100 · Vendor Advisory
• https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=20&locale=en · Note