Injection Vulnerability in Xiaomi Router R3600 Product by Xiaomi
CVE-2020-14095

9.8CRITICAL

Key Information:

Vendor
Xiaomi
Status
Xiaomi Router R3600
Vendor
CVE Published:
24 June 2020

Summary

An injection vulnerability has been identified in the web interface of the Xiaomi Router R3600, specifically in the connect service. This flaw can lead to a stack overflow or enable an attacker to execute arbitrary code remotely. Versions of the router running ROM versions earlier than 1.0.20 are particularly vulnerable. Users are advised to update their firmware to enhance security and mitigate potential threats.

Affected Version(s)

Xiaomi router R3600 ROM version<1.0.20

References

https://privacy.mi.com/trust#/security/vulnerability-mana...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.