CVE-2020-25206

HIGH EXPLOITED

Mimosa B5, B5c, C5x Firmware 1.5.2-2.8.0.2 - OS Command Injection via API

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-25206 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://cwe.mitre.org/data/definitions/78.html
Third Party Advisory x_refsource_misc
https://labs.f-secure.com/advisories/

Scores

CVSS v3 7.2
EPSS 0.0531
EPSS Percentile 91.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-12-16
CWE
CWE-78
Status published
Products (3)
mimosa/b5_firmware 1.5.2 - 2.8.0.3
mimosa/b5c_firmware 1.5.2 - 2.8.1.0
mimosa/c5c_firmware 1.5.2 - 2.8.1.0
Published Jul 20, 2021
Tracked Since Feb 18, 2026