What is CVE-2020-14140?

CVE-2020-14140 is a high-severity vulnerability in Mi Xiaomi Router Firmware, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2023-03-29.

How severe is CVE-2020-14140?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Mi Xiaomi Router Firmware

CVE-2020-14140

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.

Vulnerability class: Broken Authentication

EPSS: 0.010 (60.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Mi Xiaomi_router_firmware
N/a Xiaomi Multiple Devices — versions Xiaomi Multiple Devices, firmware update time in 2020-2022

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

security@xiaomi.com (Vendor Advisory)

Frequently asked questions

What is CVE-2020-14140?: CVE-2020-14140 is a high-severity vulnerability in Mi Xiaomi Router Firmware, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2023-03-29.
How severe is CVE-2020-14140?: High severity. CVSS v3 base score is 7.5 out of 10.