CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the setbanner function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain...

CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the setbanner function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain...

Cross site scripting

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the setbanner function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

CVE-2020-25206

CVE-2020-25206 affects Mimosa B5/B5c/C5x firmware up to 2.8.0.2. The web console exposes authenticated command injection in Throughput.php, WANStats.php, PhyStats.php, and QosStats.php endpoints, enabling an attacker with web-console access to execute OS commands and take full control of the devi...

CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the setbanner function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain...

CVE-2020-25205

The CVE-2020-25205 vulnerability affects Mimosa PTP/M5/M5c/C5x firmware up to version 2.8.0.2. It is a stored cross-site scripting flaw in the web console’s set_banner() function located at /var/www/core/controller/index.php. An unauthenticated attacker can write arbitrary JavaScript to /mnt/jffs...

Mimosa B5 跨站脚本漏洞

The Mimosa B5 is mimosa's network appliance Mimosa B5 backhaul is the easiest to deploy and highest capacity unlicensed 5 GHz backhaul solution for short and medium range link applications. A cross-site scripting vulnerability exists in the Mimosa B5c/B5/C5c that allows commands to be executed...

PT-2021-11112 · Mimosa · Mimosa B5C +1

Name of the Vulnerable Software and Affected Versions: Mimosa B5, B5c, and C5x firmware versions through 2.8.0.2 Description: The web console for the affected firmware allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access t...

Mimosa B5 操作系统命令注入漏洞

Mimosa B5 is mimosa's network device Mimosa B5 backhaul is the easiest to deploy and highest capacity unlicensed 5 GHz backhaul solution for short to medium range link applications. A security vulnerability exists in Mimosa B5, B5c that allows injection via authenticated commands in the Throughpu...

Mimosa Cloud. Invite friends, not hackers

TL;DR Global wireless network provider had an IDOR in their cloud management platform Anyone can create an account, anyone can upgrade that account to take control of anyone else’s devices Excellent VDP, responded to promptly Fixed in ONE WORKING DAY! Other vendors can learn from Mimosa Who? Mimo...

Mimosa Client Radios Information Disclosure Vulnerability

Mimosa Client Radios is a management program for client devices of the Mimosa multipoint solution from Mimosa Networks, Inc. A security vulnerability exists in Mimosa Client Radios versions prior to 2.2.3. The vulnerability can be exploited by an attacker to download arbitrary files from the devi...

Mimosa Client Radios and Mimosa Backhaul Radios Denial of Service Vulnerabilities

Mimosa Client Radios and Mimosa Backhaul Radios are both products of Mimosa Networks, Inc.Mimosa Client Radios is a hypervisor for the client devices of the Mimosa multipoint solution.Mimosa Backhaul Radios is Mimosa Backhaul Radios is a management program for broadband backhaul devices. A denial...

Unspecified Vulnerabilities in Mimosa Client Radios and Mimosa Backhaul Radios

Mimosa Client Radios and Mimosa Backhaul Radios are both products of Mimosa Networks, Inc.Mimosa Client Radios is a hypervisor for the client devices of the Mimosa multipoint solution.Mimosa Backhaul Radios is Mimosa Backhaul Radios is a management program for broadband backhaul devices. A securi...

Unspecified Vulnerability in Multiple Mimosa Products

Mimosa Client Radios, Mimosa Backhaul Radios, and Mimosa Access Points are all products of Mimosa Networks, Inc.Mimosa Client Radios is a hypervisor for the client devices of the Mimosa Multi-Point solution. Mimosa Backhaul Radios is a hypervisor for broadband backhaul devices.Mimosa Access Point...

Unspecified Vulnerability in Mimosa Client Radios and Mimosa Backhaul Radios (CNVD-2017-08182)

Mimosa Client Radios and Mimosa Backhaul Radios are both products of Mimosa Networks, Inc.Mimosa Client Radios is a hypervisor for the client devices of the Mimosa multipoint solution.Mimosa Backhaul Radios is Mimosa Backhaul Radios is a management program for broadband backhaul devices. A securi...

Command injection

An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. By connecting to the Mosquitto broker on an access point and one of its clients, an attacker can gather enough information to craft a command that reboots the client remotely when sent to the...

CVE-2017-9133

An issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. In the device's web interface, after logging in, there is a page that allows you to ping other hosts from the device and view the results. The user is allowed to specify which host to ping, but...

Authentication flaw

An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you have logged in. This information-leakage issue is relevant...