CVE-2020-11959

CVE-2020-11959 : The issue arises from an unsafe configuration of nginx in the Xiaomi router R3600 ROM prior to version 1.0.50, leading to information leakage. The vulnerability affects the router’s handling of its web services, with the root cause described as an unsafe configuration rather than...

CVE-2020-14095

In Xiaomi router R3600, ROM version1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution...

CVE-2020-14094

In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...

CVE-2020-14095

In Xiaomi router R3600, ROM version1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution...

CVE-2020-14094

In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...

Stack overflow

In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...

Stack overflow

In Xiaomi router R3600, ROM version1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution...

CVE-2020-14094

In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...

CVE-2020-14094

The CVE-2020-14094 entry concerns the Xiaomi router R3600 with ROM version

CVE-2020-14095

In Xiaomi router R3600, ROM version1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution...

CVE-2020-14095

CVE-2020-14095 affects the Xiaomi R3600 router with ROM versions earlier than 1.0.20. A vulnerability in the connect service exposed via the web interface can cause a stack overflow and may allow remote code execution. The issue is documented across multiple sources (NVD, Red Hat, CNVD, etc.), al...

Xiaomi: Insecure file upload in xiaoai.mi.com Lead to Stored XSS

Insecure file upload in xiaoai.mi.com Lead to Stored but self XSS...

Xiaomi tech Xiaomi 6 phone has denial of service vulnerability

Xiaomi Mi Phone 6 is a flagship device officially announced on April 19, 2017 by Xiaomi. Xiaomi Technology Xiaomi Phone 6 has a denial of service vulnerability that can be exploited by attackers to cause the device to crash...

Xiaomi: DOM-based XSS in d.miwifi.com on IE 11

There is a DOM based XSS on d.miwifi.com but it only works on IE 11...

Xiaomi: CORS Misconfiguration, could lead to disclosure of users information

This will result in the leakage of the users IP by exploiting this cors misconfiguration issue There is no impact...

Change This Browser Setting to Stop Xiaomi from Spying On Your Incognito Activities

If you own a Xiaomi smartphone or have installed the Mi browser app on any of your other brand Android device, you should enable a newly introduced privacy setting immediately to prevent the company from spying on your online activities. The smartphone maker has begun rolling out an update to its...

Change This Browser Setting to Stop Xiaomi from Spying On Your Incognito Activities

If you own a Xiaomi smartphone or have installed the Mi browser app on any of your other brand Android device, you should enable a newly introduced privacy setting immediately to prevent the company from spying on your online activities. The smartphone maker has begun rolling out an update to its...

Xiaomi Xiao AI Speaker Pro LX06 Input Validation Error Vulnerability

Xiaomi Xiao AI Speaker Pro LX06 is a smart speaker from Chinese company Xiaomi Technology Xiaomi. An input validation error vulnerability exists in the Xiaomi Xiao AI Speaker Pro LX06 version 1.58.10. The vulnerability can be exploited by activating failsafe mode and using the miconsole command t...

Xiaomi Xiao AI Speaker Pro LX06 Input Validation Error Vulnerability

The Xiaomi Xiao AI Speaker Pro LX06 is a smart speaker from Chinese company Xiaomi Technology Xiaomi. An input validation error vulnerability exists in Xiaomi Xiao AI Speaker Pro LX06 version 1.52.4. The vulnerability can be exploited to obtain a root shell by accessing the UART interface, which...

CVE-2020-10262

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the miconsole command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can i read Wi-Fi SSID or password, ...