{"containers": {"cna": {"affected": [{"product": "Xiaomi Router AX3600", "vendor": "n/a", "versions": [{"status": "affected", "version": "Xiaomi Router AX1800 rom version < 1.1.12"}]}], "descriptions": [{"lang": "en", "value": "There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12"}], "problemTypes": [{"descriptions": [{"description": "resulting in command execution under administrator authority", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-09-16T11:55:33", "orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909", "shortName": "Xiaomi"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@xiaomi.com", "ID": "CVE-2020-14109", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Xiaomi Router AX3600", "version": {"version_data": [{"version_value": "Xiaomi Router AX1800 rom version < 1.1.12"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "resulting in command execution under administrator authority"}]}]}, "references": {"reference_data": [{"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh", "refsource": "MISC", "url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh"}]}}}}, "cveMetadata": {"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909", "assignerShortName": "Xiaomi", "cveId": "CVE-2020-14109", "datePublished": "2021-09-16T11:55:33", "dateReserved": "2020-06-15T00:00:00", "dateUpdated": "2021-09-16T11:55:33", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mi:ax3600_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "96775913-9D30-49BB-AAE2-8418F5994AF3", "versionEndIncluding": "1.1.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mi:ax3600:-:*:*:*:*:*:*:*", "matchCriteriaId": "FCDA6605-7C59-41C2-BA6E-65268D15FA21", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12"}, {"lang": "es", "value": "Se presenta una inyecci\u00f3n de comandos en el programa meshd en el sistema de enrutamiento, resultando en una ejecuci\u00f3n de comandos bajo la autoridad del administrador en Xiaomi router AX3600 con la versi\u00f3n de ROM anteriores a 1.1.12, incluy\u00e9ndola"}], "id": "CVE-2020-14109", "lastModified": "2021-09-27T17:04:52.530", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-16T12:15:07.087", "references": [{"source": "security@xiaomi.com", "tags": ["Broken Link"], "url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh"}], "sourceIdentifier": "security@xiaomi.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}