CVE-2020-14097
📋 TL;DR
This vulnerability in Xiaomi router AX6 allows unauthorized access to download specific files due to incorrect nginx configuration. Attackers can access sensitive files without authentication. Only Xiaomi router AX6 devices with ROM versions below 1.0.18 are affected.
💻 Affected Systems
- Xiaomi router AX6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers download sensitive configuration files containing credentials, network topology, or personal data, leading to complete network compromise.
Likely Case
Unauthorized access to router configuration files exposing network settings and potentially credentials.
If Mitigated
Limited exposure if files contain only non-sensitive information or access is blocked by network controls.
🎯 Exploit Status
Exploitation requires knowledge of specific vulnerable paths but is straightforward once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ROM version 1.0.18 or later
Vendor Advisory: https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=21&locale=en
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Check for firmware updates. 3. Install update to version 1.0.18 or later. 4. Reboot router after update.
🔧 Temporary Workarounds
Block external access
allDisable remote administration and ensure router is not exposed to internet
Network segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace vulnerable router with patched model
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is below 1.0.18, device is vulnerable.Check Version:
Check via router web interface at 192.168.31.1 or via SSH if enabledVerify Fix Applied:
Confirm firmware version is 1.0.18 or higher in router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns to specific paths in nginx logs
- Unauthorized access attempts to router configuration endpoints
Network Indicators:
- External IP addresses accessing router management interface
- Unusual download patterns from router
SIEM Query:
source="router_logs" AND (uri CONTAINS "/config/" OR uri CONTAINS "/backup/") AND response_code=200