PT-2021-9696 · Xiaomi · Xiaomi Router Ax3600

Published 2021-09-16 · Updated 2021-09-27 · CVE-2020-14109

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xiaomi router AX3600 versions <= 1.1.12

Description The issue is related to command injection in the meshd program within the routing system. This results in the execution of commands under administrator authority.

Recommendations For versions <= 1.1.12, update to a version greater than 1.1.12 to resolve the issue. As a temporary workaround, consider restricting access to the meshd program to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2020-14109

Affected Products

Xiaomi Router Ax3600

References · 4

• https://osv.dev/vulnerability/CVE-2020-14109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14109 · Security Note
• https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh · Note
• https://t.me/cibsecurity/28972 · Telegram Post