CVE-2020-10262

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the mi_console command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro (LX06), (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’s SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.

• https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10262.mdExploit, Third Party Advisory
• https://sec.xiaomi.comVendor Advisory
• https://www.youtube.com/watch?v=Cr5DupGxmL4Exploit, Third Party Advisory
• https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10262.mdExploit, Third Party Advisory
• https://sec.xiaomi.comVendor Advisory
• https://www.youtube.com/watch?v=Cr5DupGxmL4Exploit, Third Party Advisory

Published

Apr 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10252An issue was discovered in ownCloud before 10.4. Because of …8.3
• CVE-2020-10254An issue was discovered in ownCloud before 10.4. An attacker…5.9
• CVE-2020-10255Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected …9
• CVE-2020-10256An issue was discovered in beta versions of the 1Password co…9.8
• CVE-2020-10257The ThemeREX Addons plugin before 2020-03-09 for WordPress l…9.8
• CVE-2020-1026A Security Feature Bypass vulnerability exists in the MSR Ja…9.8
• CVE-2020-10263An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.…6.8
• CVE-2020-10264CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and …8.8
• CVE-2020-10265Universal Robots Robot Controllers Version CB2 SW Version 1.…9.4
• CVE-2020-10266UR+ (Universal Robots+) is a platform of hardware and softwa…8.1
• CVE-2020-10267Universal Robots control box CB 3.1 across firmware versions…7.5
• CVE-2020-10268Critical services for operation can be terminated from windo…6.1