High severity · published Sep 16, 2021
CVE-2020-14109
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =<…
7.2
CVSS
2.2%
EPSS
No
On KEV
Description
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ax3600 Firmware · MI
through 1.1.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14109
Broken Link
https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh
More from Ax3600 Firmware
9.8
CVE-2020-14115
A command injection vulnerability exists in the Xiaomi Router AX3600
9.8
CVE-2020-14124
There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12
8.1
CVE-2020-14104
A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50
7.8
CVE-2020-14111
A command injection vulnerability exists in the Xiaomi Router AX3600
7.8
CVE-2020-14110
AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background