CVE-2020-14098

The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14097

Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version 1.0.18...

CVE-2020-14097

Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version 1.0.18...

CVE-2020-14101

The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14102

There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

Command injection

There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

Design/Logic Flaw

The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

Authorization

Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version 1.0.18...

Design/Logic Flaw

The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14102

There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14102

The CVE-2020-14102 entry describes a command injection in the router’s Dynamic DNS (ddns) hostname processing, enabling attempted privilege escalation to root for the administrator user. Affected devices include Xiaomi AX1800rom software versions prior to 1.0.336 and Xiaomi RM1800 root prior to 1...

CVE-2020-14098

The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14098

The CVE affects Xiaomi network devices: AX1800rom and RM1800 root. Vulnerable components are the login verification mechanism impacted by a time synchronization issue that occurs after router restarts, allowing bypass of login verification. Root cause: time desynchronization after restart enables...

CVE-2020-14097

Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version 1.0.18...

CVE-2020-14097

CVE-2020-14097 involves a misconfigured nginx setup on the Xiaomi Router AX6, affecting ROM versions earlier than 1.0.18. The root cause is a wrong nginx configuration that allows certain paths to be downloaded without authorization. This leads to potential unauthorized access to restricted resou...

CVE-2020-14101

The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version 1.0.336 and Xiaomi route RM1800 root version 1.0.26...

CVE-2020-14101

CVE-2020-14101 affects Xiaomi router software: the data collection SDK in the web management interface causes leakage of the authentication token in affected builds—AX1800ROM < 1.0.336 and RM1800 Root

Xiaomi AX1800 Security Vulnerability

The Xiaomi AX1800 is a router from the Chinese company Xiaomi Xiaomi. A security vulnerability exists in the Xiaomi router that stems from an issue where the time is not synchronized after a router reboot, which can bypass login authentication. The following products and versions are affected:...

Xiaomi router security vulnerability

Xiaomi AX1800 is a router from Chinese company Xiaomi Xiaomi. A security vulnerability exists in the Xiaomi router, which originates from a token leak in the data collection SDK of the web management interface. The following products and versions are affected: Xiaomi router AX1800rom version...

Xiaomi AX1800 命令注入漏洞

The Xiaomi AX1800 is a router from the Chinese company Xiaomi. A command injection vulnerability exists in Xiaomi AX1800 and others, which can be exploited by an attacker to submit a special request to inject arbitrary OS commands and execute them...