Mi Ax3600 Firmware vulnerabilities

CVE-2020-14115 [CRITICAL] CWE-345 CVE-2020-14115: A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

CVE-2020-14124 [CRITICAL] CWE-120 CVE-2020-14124: There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code executi There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12.

CVE-2020-14109 [HIGH] CWE-77 CVE-2020-14109: There is command injection in the meshd program in the routing system, resulting in command executio There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12

CVE-2020-14111 [HIGH] CWE-345 CVE-2020-14111: A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.

CVE-2020-14104 [HIGH] CWE-362 CVE-2020-14104: A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM vers A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.

CVE-2020-14110 [HIGH] CWE-863 CVE-2020-14110: AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.