PT-2023-11474 · Xiaomi · Xiaomi Router Firmware

Published 2023-03-29 · Updated 2025-02-18 · CVE-2020-14140

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xiaomi router firmware (affected versions not specified)

Description The issue is caused by the lack of access control policies on some API interfaces, allowing attackers to exploit an unauthenticated API and reveal the WIFI password. This can lead to background command injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-14140

Affected Products

Xiaomi Router Firmware

References · 5

• https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14140 · Security Note
• https://t.me/cvenotify/111639 · Telegram Post
• https://t.me/cibsecurity/61154 · Telegram Post