Vulnerability · Published Mar 29, 2023 · Assigned by Xiaomi
CVE-2020-14140
High 7.5
In plain English
A high-severity missing authentication in Xiaomi Multiple Devices. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 37.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Xiaomi Multiple Devices | Xiaomi Multiple Devices, firmware update time in 2020-2022 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N