CVE-2020-14120

Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=145	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:mi:miui:12.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-04-21 18:15

Updated : 2024-02-28 19:09

NVD link : CVE-2020-14120

Mitre link : CVE-2020-14120

CVE.ORG link : CVE-2020-14120

JSON object : View

Products Affected

mi

miui

CWE

CWE-354

Improper Validation of Integrity Check Value

{"id": "CVE-2020-14120", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-04-21T18:15:08.570", "references": [{"url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=145", "tags": ["Vendor Advisory"], "source": "security@xiaomi.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected."}, {"lang": "es", "value": "Algunos modelos de Xiaomi presentan una vulnerabilidad en una aplicaci\u00f3n determinada. La vulnerabilidad est\u00e1 causada por una falta de suma de comprobaci\u00f3n cuando es usada una aplicaci\u00f3n tripartita para pasar par\u00e1metros, y los atacantes pueden inducir a usuarios a instalar una aplicaci\u00f3n maliciosa y usar la vulnerabilidad para conseguir altos privilegios, haciendo que los servicios normales del sistema est\u00e9n afectados"}], "lastModified": "2022-05-03T16:06:20.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mi:miui:12.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7201F16F-F25C-4DC9-A1E8-53211931F011"}], "operator": "OR"}]}], "sourceIdentifier": "security@xiaomi.com"}