When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
References
| Link | Resource |
|---|---|
| https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506 | Vendor Advisory |
| https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506 | Vendor Advisory |
Configurations
History
18 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506 - Vendor Advisory |
06 Apr 2023, 17:48
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 | |
| CPE | cpe:2.3:o:mi:xiaomi_router_firmware:*:*:*:*:*:*:*:* | |
| First Time |
Mi
Mi xiaomi Router Firmware |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506 - Vendor Advisory |
Information
Published : 2023-03-29 20:15
Updated : 2025-02-18 18:15
NVD link : CVE-2020-14140
Mitre link : CVE-2020-14140
JSON object : View
Products Affected
mi
- xiaomi_router_firmware
CWE
CWE-306
Missing Authentication for Critical Function