« Volver al listado

CVE-2020-14115

Estado: ModificadaCrítica (9.8)—

A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

MI — Ax3600 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14115",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@xiaomi.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Xiaomi Router AX3600",
          "versions": [
            {
              "status": "affected",
              "version": "Xiaomi Router AX3600 version < 1.0.67"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-10T17:41:16.620",
  "references": [
    {
      "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=37",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@xiaomi.com"
    },
    {
      "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=37",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyección de comandos en Xiaomi Router AX3600. La vulnerabilidad está causada por una falta de inspección para la detección de datos entrantes. Los atacantes pueden explotar esta vulnerabilidad para ejecutar código"
    }
  ],
  "lastModified": "2026-06-17T02:54:15.213",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mi:ax3600_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E91EF37F-3698-458C-8D15-5C2EA4D7AE90",
              "versionEndExcluding": "1.0.67"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mi:ax3600:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FCDA6605-7C59-41C2-BA6E-65268D15FA21"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@xiaomi.com"
}