CVE-2020-25206

HIGH

mimosa b5_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-25206 has a selected CVSS score of 7.2 (high).

Description

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 16, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Affected products and versions

1
ProductSourceVersion range

b5_firmware

Browse mimosa / b5_firmware
VulnCheckVersion data not supplied

References

4