CVE-2020-8994

Katalog CVE

CVSS 6.8 · Medium EPSS 0,56%

Kerentanan Improper Authentication pada mi mdz-25-dt firmware. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor

Rincian

Terbit di NVD

5 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-8994.md exploit · advisory pihak ketiga
• https://www.usenix.org/sites/default/files/soups2018posters-lau.pdf deskripsi teknis · advisory pihak ketiga
• https://youtu.be/yCadG38yZW8 exploit · advisory pihak ketiga