CVE-2020-25206

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-252079.8JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.CVE-2020-252085.3In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.CVE-2020-252097.5In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.CVE-2020-252105.3In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.CVE-2020-252116.0In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing cra CVE-2020-252127.0A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly hav CVE-2020-252139.8The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because CVE-2020-252148.1In the client in Overwolf 0.149.2.30, a channel can be accessed or influenced by an actor that is not an endpoint.CVE-2020-252159.8yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.CVE-2020-252169.8yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesh CVE-2020-252177.2Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.CVE-2020-252189.8Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.