CVE-2020-14102
Last modified
CVE-2020-14102 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.. EPSS estimates a 1.88% chance of exploitation in the next 30 days.
Description
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mi | Ax1800 Firmware | < 1.0.336 |
| Mi | Rm1800 Firmware | < 1.0.26 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-14102?
How severe is CVE-2020-14102?
How do I fix CVE-2020-14102?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-14097Wrong nginx configuration, causing specific paths to be down…7.5
- CVE-2020-14098The login verification can be bypassed by using the problem …7.5
- CVE-2020-14099On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 roo…7.5
- CVE-2020-1410A remote code execution vulnerability exists when Windows Ad…7.8
- CVE-2020-14100In Xiaomi router R3600 ROM version<1.0.66, filters in the se…9.8
- CVE-2020-14101The data collection SDK of the router web management interfa…7.5
- CVE-2020-14103The application in the mobile phone can read the SNO informa…5.5
- CVE-2020-14104A RACE CONDITION on XQBACKUP causes a decompression path err…8.1
- CVE-2020-14105The application in the mobile phone can read the SNO informa…5.5
- CVE-2020-14106The application in the mobile phone can unauthorized access …5.5
- CVE-2020-14107A stack overflow in the HTTP server of Cast can be exploited…7.5
- CVE-2020-14109There is command injection in the meshd program in the routi…7.2
Are you affected by CVE-2020-14102?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST