What’s Vulnerable › Vulnerabilities

CVE-2020-25205

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-20 · updated 2026-06-17
• Weakness: CWE-79

Description

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.

Affected products

• Mimosa B5 Firmware: through 2.8.0.3
• Mimosa B5C Firmware: through 2.8.0.3
• Mimosa C5C Firmware: through 2.8.0.3

References

• https://labs.f-secure.com/advisories/
• https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/
• https://labs.f-secure.com/advisories/
• https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/

Get alerted when CVE-2020-25205 or the next vulnerability affects your stack