Mi vulnerabilities, page 2
101 vulnerabilities
Known vulnerabilities in Mi products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 80 products.
CVE-2020-14100mir3600_firmware
EPSS score5.59%
In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router administrator can gain root access from this vulnerability.CVE-2020-14140mixiaomi_router_firmwareEPSS score0.99%
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.CVE-2020-14131mixiaomiEPSS score0.99%
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.CVE-2020-14099miax1800_firmware+1EPSS score0.60%
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.CVE-2020-14096mixiaomi_ai_speaker_firmwareEPSS score1.21%
Memory overflow in Xiaomi AI speaker Rom version <1.59.6 can happen when the speaker verifying a malicious firmware during OTA process.CVE-2020-14119miax3600_firmwareEPSS score2.96%
There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom< 1.1.12CVE-2020-14112miax6000_firmwareEPSS score0.78%
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000.CVE-2020-14114mismarthomeEPSS score0.74%
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.CVE-2020-14122mimiuiEPSS score0.16%
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage.CVE-2020-14103mimiuiEPSS score0.70%
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14117micontent_centerEPSS score0.69%
A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permission verification in the Xiaomi content center APP, and attackers can use this vulnerability to invoke the sensitive component functions of the Xiaomi content center APP.CVE-2020-14109miax3600_firmwareEPSS score2.17%
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12CVE-2020-14095mixiaomi_r3600_firmware+1EPSS score2.33%
In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution.CVE-2020-14107mixiaomi_mirror_screenEPSS score0.96%
A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.CVE-2020-14106mimiuiEPSS score0.66%
The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.CVE-2020-14120mimiuiEPSS score0.41%
Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected.CVE-2020-14102miax1800_firmware+1EPSS score1.91%
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.CVE-2020-14126misoundEPSS score0.74%
Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.CVE-2020-14105mimiuiEPSS score0.26%
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14116mimi_browserEPSS score0.44%
An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity of the incoming data. Attackers can perform sensitive operations by exploiting this.