MI vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2020-14140 When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability.High 7.5 · Mar 29, 2023
• CVE-2020-14131 The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experCritical 9.8 · Oct 11, 2022
• CVE-2020-14129 A logic vulnerability exists in a Xiaomi product.Critical 9.8 · Oct 11, 2022
• CVE-2020-14126 Information leakage vulnerability exists in the Mi Sound APP.High 7.5 · Jul 22, 2022
• CVE-2020-14114 information leakage vulnerability exists in the Xiaomi SmartHome APP.High 7.5 · Jul 22, 2022
• CVE-2020-14127 A denial of service vulnerability exists in some Xiaomi models of phones.High 7.5 · Jul 14, 2022
• CVE-2022-31277 Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks.High 8.8 · Jun 16, 2022
• CVE-2020-14125 A denial of service vulnerability exists in some Xiaomi models of phones.High 7.5 · Jun 8, 2022
• CVE-2020-14123 There is a pointer double free vulnerability in Some MIUI Services.High 7.5 · Apr 22, 2022
• CVE-2020-14120 Some Xiaomi models have a vulnerability in a certain application.High 8.8 · Apr 21, 2022
• CVE-2020-14116 An intent redirection vulnerability in the Mi Browser product.High 7.5 · Apr 21, 2022
• CVE-2020-14115 A command injection vulnerability exists in the Xiaomi Router AX3600.Critical 9.8 · Mar 10, 2022
• CVE-2020-14111 A command injection vulnerability exists in the Xiaomi Router AX3600.High 7.8 · Mar 10, 2022
• CVE-2020-14110 AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.High 7.8 · Jan 18, 2022
• CVE-2020-14107 A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.High 7.5 · Jan 18, 2022
• CVE-2020-14124 There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12.Critical 9.8 · Sep 16, 2021
• CVE-2020-14119 There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600Critical 9.8 · Sep 16, 2021
• CVE-2020-14109 There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 withHigh 7.2 · Sep 16, 2021
• CVE-2020-14104 A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.High 8.1 · Apr 8, 2021
• CVE-2020-14099 On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can High 7.5 · Apr 8, 2021
• CVE-2020-14102 There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router.High 7.2 · Jan 13, 2021
• CVE-2020-14101 The data collection SDK of the router web management interface caused the leakage of the token.High 7.5 · Jan 13, 2021
• CVE-2020-14098 The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts.High 7.5 · Jan 13, 2021
• CVE-2020-14097 Wrong nginx configuration, causing specific paths to be downloaded without authorization.High 7.5 · Jan 13, 2021
• CVE-2020-14100 In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution.Critical 9.8 · Sep 11, 2020