Read the docs
TI-2020-11051 Aliases CVE-2020-14110GHSA-g78x-p68x-vx34

Incorrect authorization in miwifi6 AX3600

Priority LOW 34CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.

Why it matters now

EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—miwifi6 AX3600AX3600 < 1.0.67—No fix listedCNA
  • miwifi6 AX3600 Vendor— Affected AX3600 < 1.0.67 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:mi:ax3600_firmware:*:*:*:*:*:*:*:*before 1.0.67VulnerableMi
cpe:2.3:h:mi:ax3600:-:*:*:*:*:*:*:*not specified by NVDRunning onMi
  • cpe:2.3:o:mi:ax3600_firmware:*:*:*:*:*:*:*:* Versions before 1.0.67 Vulnerable ·Mi
  • cpe:2.3:h:mi:ax3600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mi

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14110
  2. 2026-10-03 Alias added: GHSA-g78x-p68x-vx34

References

Advisory 1

  • TI-2020-11064 Buffer overflow in Xiaomi Router AX3600 CVSS 3.1CRITICAL 9.8
  • TI-2020-11055 Insufficient verification of data authenticity in Xiaomi Router AX3600 CVSS 3.1CRITICAL 9.8
  • TI-2020-11050 Command injection in Xiaomi Router AX3600 CVSS 3.1HIGH 7.2
  • TI-2020-11046 A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50. CVSS 3.1HIGH 8.1
  • TI-2020-11052 Insufficient verification of data authenticity in Xiaomi Router Router AX3600 CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences