Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (19 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-14140 1 Mi 1 Xiaomi Router Firmware 2025-02-18 7.5 High
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by the lack of access control policies on some API interfaces. Attackers can exploit this vulnerability to enter the background and execute background command injection.
CVE-2022-31277 1 Mi 2 Xiaomi Lamp 1, Xiaomi Lamp 1 Firmware 2024-11-21 8.8 High
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.
CVE-2020-14131 1 Mi 1 Xiaomi 2024-11-21 9.8 Critical
The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
CVE-2020-14130 1 Mi 1 Xiaomi 2024-11-21 5.3 Medium
Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809
CVE-2020-14129 1 Mi 1 Xiaomi 2024-11-21 9.8 Critical
A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege.
CVE-2020-14107 1 Mi 1 Xiaomi Mirror Screen 2024-11-21 7.5 High
A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.
CVE-2020-14096 1 Mi 2 Xiaomi Ai Speaker, Xiaomi Ai Speaker Firmware 2024-11-21 9.8 Critical
Memory overflow in Xiaomi AI speaker Rom version <1.59.6 can happen when the speaker verifying a malicious firmware during OTA process.
CVE-2020-14095 1 Mi 2 Xiaomi R3600, Xiaomi R3600 Firmware 2024-11-21 9.8 Critical
In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or remote code execution.
CVE-2020-14094 1 Mi 2 Xiaomi R3600, Xiaomi R3600 Firmware 2024-11-21 9.8 Critical
In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution.
CVE-2020-11961 1 Mi 2 Xiaomi R3600, Xiaomi R3600 Firmware 2024-11-21 7.5 High
Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication
CVE-2020-11960 1 Mi 2 Xiaomi R3600, Xiaomi R3600 Firmware 2024-11-21 9.8 Critical
Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in c_upload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS
CVE-2020-11959 1 Mi 2 Xiaomi R3600, Xiaomi R3600 Firmware 2024-11-21 7.5 High
An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50.
CVE-2020-10263 1 Mi 2 Xiaomi Xiaoai Speaker Pro Lx06, Xiaomi Xiaoai Speaker Pro Lx06 Firmware 2024-11-21 6.8 Medium
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro LX06, (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’ SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
CVE-2020-10262 1 Mi 2 Xiaomi Xiaoai Speaker Pro Lx06, Xiaomi Xiaoai Speaker Pro Lx06 Firmware 2024-11-21 6.8 Medium
An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the mi_console command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro (LX06), (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’s SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
CVE-2019-15843 1 Mi 1 Xiaomi Millet Firmware 2024-11-21 7.4 High
A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing.
CVE-2018-18698 1 Mi 2 Xiaomi Mi-a1, Xiaomi Mi-a1 Firmware 2024-11-21 N/A
An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords in logcat during the process of setting up the phone as a hotspot.
CVE-2018-16307 1 Mi 2 Xiaomi Miwifi Xiaomi 55dd, Xiaomi Miwifi Xiaomi 55dd Firmware 2024-11-21 N/A
An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name (containing a random string) is used in the HTTP Host header, the application performs an HTTP request to the specified domain. The response from that request is then included in the application's own response.
CVE-2018-14060 1 Mi 2 Xiaomi R3d, Xiaomi R3d Firmware 2024-11-21 N/A
OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
CVE-2018-14010 1 Mi 7 Xiaomi R3, Xiaomi R3c, Xiaomi R3c Firmware and 4 more 2024-11-21 N/A
OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.