Lucene search

XiaomiCVE-2020-14101

HistoryJan 13, 2021 - 11:15 p.m.

CVE-2020-14101

2021-01-1323:15:13

Xiaomi

web.nvd.nist.gov

cve-2020-14101

data collection sdk

token leakage

xiaomi router

ax1800rom

rm1800 root

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

56.6%

JSON

The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.

Affected configurations

Nvd

Node

miax1800_firmwareRange<1.0.336

AND

miax1800Match-

Node

mirm1800_firmwareRange<1.0.26

AND

mirm1800Match-

VendorProductVersionCPE
miax1800_firmware*cpe:2.3:o:mi:ax1800_firmware:*:*:*:*:*:*:*:*
miax1800-cpe:2.3:h:mi:ax1800:-:*:*:*:*:*:*:*
mirm1800_firmware*cpe:2.3:o:mi:rm1800_firmware:*:*:*:*:*:*:*:*
mirm1800-cpe:2.3:h:mi:rm1800:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mi	ax1800_firmware	*	cpe:2.3:o:mi:ax1800_firmware::::::::
mi	ax1800	-	cpe:2.3:h:mi:ax1800:-:::::::*
mi	rm1800_firmware	*	cpe:2.3:o:mi:rm1800_firmware::::::::
mi	rm1800	-	cpe:2.3:h:mi:rm1800:-:::::::*

CNA Affected

[
  {
    "product": "Xiaomi router AX1800",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Xiaomi router AX1800rom version < 1.0.336"
      }
    ]
  },
  {
    "product": "Xiaomi route RM1800",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Xiaomi route RM1800 root version < 1.0.26"
      }
    ]
  }
]

References

privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24&locale=en

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

56.6%

JSON

Related for CVE-2020-14101