CVE-2020-14140

7.5 highEPSS 1.0%

High (7.5) in mi xiaomi router firmware. EPSS 1.0% chance of exploitation in the next 30 days.

When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2023-03-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mi:xiaomi_router_firmware

References

https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=506

Check your stack JSON