CVE-2020-14119
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands with administrator privileges on Xiaomi AX3600 routers. Attackers can exploit a command injection flaw in the addMeshNode interface to take full control of affected devices. Only routers with firmware versions below 1.1.12 are vulnerable.
💻 Affected Systems
- Xiaomi Router AX3600
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent backdoors, pivot to internal networks, and use the router for botnet activities.
Likely Case
Router takeover enabling traffic monitoring, DNS hijacking, credential theft from connected devices, and installation of malware.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and regular monitoring detects anomalous behavior.
🎯 Exploit Status
Command injection vulnerabilities are typically easy to exploit with publicly available techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.1.12 or later
Vendor Advisory: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=16
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Settings > Firmware Update. 3. Check for updates and install version 1.1.12 or newer. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable Remote Administration
allPrevent external access to router administration interface
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace vulnerable router with updated model
- Implement strict firewall rules blocking all WAN access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is below 1.1.12, device is vulnerable.Check Version:
Login to router web interface and check System Status or Firmware Information page.Verify Fix Applied:
Confirm firmware version shows 1.1.12 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- Failed authentication attempts to router admin
- Unexpected process execution
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs
- DNS queries to suspicious domains
SIEM Query:
source="router_logs" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")