« Volver al listado

CVE-2020-14129

Estado: ModificadaCrítica (9.8)—

A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

MI — Xiaomi

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14129",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@xiaomi.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Xiaomi a certain APP",
          "versions": [
            {
              "status": "affected",
              "version": "Affected Version:3.4.5.18 Fixed Version:3.4.5.24"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-11T20:15:10.267",
  "references": [
    {
      "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@xiaomi.com"
    },
    {
      "url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=155",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad lógica en un producto de Xiaomi. La vulnerabilidad está causada por un fallo de verificación de identidad, que puede ser explotado por un atacante que puede obtener una breve elevación de privilegios"
    }
  ],
  "lastModified": "2026-06-17T02:54:16.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mi:xiaomi:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F9C6762-9C78-47DC-9306-59762DE70629"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@xiaomi.com"
}