CVE-2020-10263

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro LX06, (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’ SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.

• CWE-306

• https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10263.mdExploit, Third Party Advisory
• https://sec.xiaomi.comVendor Advisory
• https://www.youtube.com/watch?v=Cr5DupGxmL4Exploit, Third Party Advisory
• https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10263.mdExploit, Third Party Advisory
• https://sec.xiaomi.comVendor Advisory
• https://www.youtube.com/watch?v=Cr5DupGxmL4Exploit, Third Party Advisory

Published

Apr 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10254An issue was discovered in ownCloud before 10.4. An attacker…5.9
• CVE-2020-10255Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected …9
• CVE-2020-10256An issue was discovered in beta versions of the 1Password co…9.8
• CVE-2020-10257The ThemeREX Addons plugin before 2020-03-09 for WordPress l…9.8
• CVE-2020-1026A Security Feature Bypass vulnerability exists in the MSR Ja…9.8
• CVE-2020-10262An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.…6.8
• CVE-2020-10264CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and …8.8
• CVE-2020-10265Universal Robots Robot Controllers Version CB2 SW Version 1.…9.4
• CVE-2020-10266UR+ (Universal Robots+) is a platform of hardware and softwa…8.1
• CVE-2020-10267Universal Robots control box CB 3.1 across firmware versions…7.5
• CVE-2020-10268Critical services for operation can be terminated from windo…6.1
• CVE-2020-10269One of the wireless interfaces within MiR100, MiR200 and pos…9.8