CVE-2020-14140 — n/a / Xiaomi Multiple Devices

Description (CNA)

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.

Affected (CNA)

Vendor / product	Versions
n/a / Xiaomi Multiple Devices	affected Xiaomi Multiple Devices, firmware update time in 2020-2022

CWE

No CWE identifiers supplied.

References

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506

ADP enrichment

CVE

No English description supplied.

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506

CISA-ADP

No English description supplied.

No references supplied.