CVE-2020-14130

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-16 · updated 2026-06-17
Weakness: CWE-668

Description

Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210809

Affected products

Xiaomi specific devices: before 3.0.210809 — fixed in 3.0.210809

How to fix

Upgrade to a fixed version: Xiaomi specific devices 3.0.210809. Check the vendor advisory for mitigations.

References

https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh
https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25&locale=zh

Get alerted when CVE-2020-14130 or the next vulnerability affects your stack