CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of…

published July 20, 2021

CVSS
—
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00905 · 59.4th percentile
Published
2021-07-20T18:45Z
EPSS history
Timeline
  • 20 JUL 18:45Z
    The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of…
    cvelistv5