CVE-2020-14115

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-141167.5An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not verify the validity o CVE-2020-141175.3A improper permission configuration vulnerability in Xiaomi Content Center APP. This vulnerability is caused by the lack of correct permissi CVE-2020-141186.1An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validi CVE-2020-141199.8There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on CVE-2020-14128.8A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics CVE-2020-141208.8Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-par CVE-2020-141215.5A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being byp CVE-2020-141225.5Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of pa CVE-2020-141237.5There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function CVE-2020-141249.8There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM vers CVE-2020-141257.5A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be CVE-2020-141267.5Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces,