VulnerabilityModified
CVE-2020-14102
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router.
HIGH 7.2EPSS 1.88%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.88% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- mi/ax1800 firmware · mi/rm1800 firmware
- Source
- security@xiaomi.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.