CVE-2020-14140 Missing authorization in Xiaomi Multiple Devices
Unauthenticated API access allows attackers to reveal WiFi passwords and execute command injection on Xiaomi routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14140?
CVE-2020-14140 is a high-severity missing authorization vulnerability in Xiaomi Multiple Devices, published on 29 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
Weakness: CWE-306
Which versions are affected by CVE-2020-14140?
It affects 1 product.
Products include Mi Xiaomi Router Firmware.
How do I fix CVE-2020-14140?
No fix has been published for CVE-2020-14140 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-14140 being exploited?
There is no known exploitation of CVE-2020-14140 in the wild and no public exploit code.
Other vulnerabilities in Xiaomi Multiple Devices
Sources
Also known as GHSA-7h5h-fqwm-4g32.