CVE-2020-14111

A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

• CWE-345

• https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=18Vendor Advisory
• https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=18Vendor Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14105The application in the mobile phone can read the SNO informa…5.5
• CVE-2020-14106The application in the mobile phone can unauthorized access …5.5
• CVE-2020-14107A stack overflow in the HTTP server of Cast can be exploited…7.5
• CVE-2020-14109There is command injection in the meshd program in the routi…7.2
• CVE-2020-1411An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14110AX3600 router sensitive information leaked.There is an unaut…7.8
• CVE-2020-14112Information Leak Vulnerability exists in the Xiaomi Router A…5.3
• CVE-2020-14114information leakage vulnerability exists in the Xiaomi Smart…7.5
• CVE-2020-14115A command injection vulnerability exists in the Xiaomi Route…9.8
• CVE-2020-14116An intent redirection vulnerability in the Mi Browser produc…7.5
• CVE-2020-14117A improper permission configuration vulnerability in Xiaomi …5.3
• CVE-2020-14118An intent redirection vulnerability in the Mi App Store prod…6.1