CVE-2020-8994
Last modified
CVE-2020-8994 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mi | Mdz-25-Dt Firmware | 1.34.36 |
| Mi | Mdz-25-Dt Firmware | 1.40.14 |
References
- https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-8994.mdExploit, Third Party Advisory
- https://www.usenix.org/sites/default/files/soups2018posters-lau.pdfTechnical Description, Third Party Advisory
- https://youtu.be/yCadG38yZW8Exploit, Third Party Advisory
- https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-8994.mdExploit, Third Party Advisory
- https://www.usenix.org/sites/default/files/soups2018posters-lau.pdfTechnical Description, Third Party Advisory
- https://youtu.be/yCadG38yZW8Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8994?
How severe is CVE-2020-8994?
How do I fix CVE-2020-8994?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-8987Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.…7.4
- CVE-2020-8988The Voatz application 2020-01-01 for Android allows only 100…5.9
- CVE-2020-8989In the Voatz application 2020-01-01 for Android, the amount …5.3
- CVE-2020-8990Western Digital My Cloud Home before 3.6.0 and ibi before 3.…9.1
- CVE-2020-8991vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mis…2.3
- CVE-2020-8992ext4_protect_reserved_inode in fs/ext4/block_validity.c in t…5.5
- CVE-2020-8995Programi Bilanc Build 007 Release 014 31.01.2020 supplies a …9.8
- CVE-2020-8996AnyShare Cloud 6.0.9 allows authenticated directory traversa…4.3
- CVE-2020-8997Older generation Abbott FreeStyle Libre sensors allow remote…8.8
- CVE-2020-8998Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-8999Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-9000An issue was discovered in iPortalis iCS 7.1.13.0. Attackers…7.5
Are you affected by CVE-2020-8994?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST