Security readout for executives and security teams
Plain-English summary
Xiaomi Router AX6000 firmware before version 1.0.56 has an information leak issue. The public record says incorrect routing configuration can let attackers download part of the router's files. Business impact depends on what files are exposed and where affected routers are deployed; the available sources do not quantify severity.
Executive priority
Treat this as a targeted asset hygiene issue unless AX6000 routers support sensitive networks or are broadly exposed. Prioritize finding and updating affected routers, because the source confirms file disclosure risk but does not provide severity scoring or exploitation evidence.
Technical view
CVE-2020-14112 affects Xiaomi Router AX6000 versions earlier than 1.0.56. The issue is described as an information leak caused by incorrect routing configuration, allowing partial file download from the device. The record provides no CVSS score, CWE mapping, detailed prerequisites, or confirmed exploit chain.
Likely exposure
Exposure is limited to Xiaomi Router AX6000 devices running firmware earlier than 1.0.56. Public sources do not identify other Xiaomi models, cloud services, or third-party products as affected.
Exploitation context
The CVE description states attackers can download part of the files on affected routers. There is no KEV listing in the provided bundle and no cited source confirming active exploitation, public weaponization, or exploitation at scale.
Researcher notes
Evidence is sparse. The public record names the affected model and version boundary, root cause category, and high-level file disclosure impact, but does not provide attack prerequisites, authentication status, affected file paths, or exploit maturity.
Mitigation direction
- Inventory Xiaomi Router AX6000 devices and record firmware versions.
- Update devices below version 1.0.56 following Xiaomi guidance.
- Check Xiaomi's advisory for current remediation or support instructions.
- Retire or replace affected devices if no supported update path exists.
Validation and detection
- Confirm whether each AX6000 is running firmware below 1.0.56.
- Review exposed router services and management access paths.
- Check change records for successful firmware update completion.
- Monitor router logs for unusual file-access or configuration activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-14112 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=34CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.