CVE-2020-14099

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-14107.8A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability, CVE-2020-141009.8In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router admi CVE-2020-141017.5The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version CVE-2020-141027.2There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router.CVE-2020-141035.5The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-141048.1A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.CVE-2020-141055.5The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-141065.5The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI <CVE-2020-141077.5A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.CVE-2020-141097.2There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaom CVE-2020-14117.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva CVE-2020-141107.8AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the