Description
An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you have logged in. This information-leakage issue is relevant because there is another page (accessible without any authentication) that allows you to remotely factory reset the device simply by entering the serial number.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
http://blog.iancaling.com/post/160596244178
Scores
CVSS v3
7.5
EPSS
0.0119
EPSS Percentile
64.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (2)
mimosa/backhaul_radios
< 2.2.1
mimosa/client_radios
< 2.2.1
Published
May 21, 2017
Tracked Since
Feb 18, 2026