CVE-2020-14098

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-662

Affected software

Vendor	Product	Versions
n/a	Xiaomi router AX1800	Xiaomi router AX1800rom version < 1.0.336
n/a	Xiaomi route RM1800	Xiaomi route RM1800 root version < 1.0.26

References

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-140997.5On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-co CVE-2020-14107.8A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability, CVE-2020-141009.8In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router admi CVE-2020-141017.5The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version CVE-2020-141027.2There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router.CVE-2020-141035.5The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-141048.1A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.CVE-2020-141055.5The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-141065.5The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI <CVE-2020-141077.5A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.CVE-2020-141097.2There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaom CVE-2020-14117.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva