CVE-2020-14111

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
n/aXiaomi Router Router AX3600Xiaomi Router AX3600 version <1.1.15

References

Timeline

Published
Mar 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-141125.3Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. AttackersCVE-2020-141147.5information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS intCVE-2020-141159.8A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data CVE-2020-141167.5An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity oCVE-2020-141175.3A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permissiCVE-2020-141186.1An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validiCVE-2020-141199.8There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on CVE-2020-14128.8A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphicsCVE-2020-141208.8Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-parCVE-2020-141215.5A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypCVE-2020-141225.5Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of paCVE-2020-141237.5There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function
CVE-2020-14111: High severity, CVSS 7.8 | Vulnix