Lucene search

XiaomiCVE-2020-14140

HistoryMar 29, 2023 - 8:15 p.m.

CVE-2020-14140

2023-03-2920:15:07

CWE-306

Xiaomi

web.nvd.nist.gov

xiaomi

router

firmware

unauthenticated api

wifi

password

disclosure

vulnerability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.9%

JSON

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.

Affected configurations

Nvd

Node

mixiaomi_router_firmwareRange2020–2023.2

VendorProductVersionCPE
mixiaomi_router_firmware*cpe:2.3:o:mi:xiaomi_router_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mi	xiaomi_router_firmware	*	cpe:2.3:o:mi:xiaomi_router_firmware::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Xiaomi Multiple Devices",
    "versions": [
      {
        "version": "Xiaomi Multiple Devices, firmware update time in 2020-2022",
        "status": "affected"
      }
    ]
  }
]

References

trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.9%

JSON

Related for CVE-2020-14140