CVE-2020-14140

2023-03-2900:00:00

Xiaomi

www.cve.org

xiaomi

firmware

update

wifi password

vulnerability

unauthenticated api

access control

background command injection

EPSS

0.001

Percentile

34.9%

JSON

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Xiaomi Multiple Devices",
    "versions": [
      {
        "version": "Xiaomi Multiple Devices, firmware update time in 2020-2022",
        "status": "affected"
      }
    ]
  }
]

References

trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506

EPSS

0.001

Percentile

34.9%

JSON

Related for CVELIST:CVE-2020-14140