CVE-2020-25206 | BDVDB-2026-157240 Detail

Description#

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://cwe.mitre.org/data/definitions/78.html
https://labs.f-secure.com/advisories/
https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/

Exploit#

No public exploit known

History#

Version 12021-07-20Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.