CVE-2020-25205

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.

• CWE-79

• https://labs.f-secure.com/advisories/Third Party Advisory
• https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/Exploit, Third Party Advisory
• https://labs.f-secure.com/advisories/Third Party Advisory
• https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/Exploit, Third Party Advisory

Published

Jul 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25198The built-in WEB server for MOXA NPort IAW5000A-I/O firmware…8.8
• CVE-2020-25199A heap-based buffer overflow vulnerability exists within the…7.8
• CVE-2020-25200Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN…5.3
• CVE-2020-25201HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includ…7.5
• CVE-2020-25203The Framer Preview application 12 for Android exposes com.fr…5.5
• CVE-2020-25204The God Kings application 0.60.1 for Android exposes a broad…5.5
• CVE-2020-25206The web console for Mimosa B5, B5c, and C5x firmware through…7.2
• CVE-2020-25207JetBrains ToolBox before version 1.18 is vulnerable to Remot…9.8
• CVE-2020-25208In JetBrains YouTrack before 2020.4.4701, an attacker could …5.3
• CVE-2020-25209In JetBrains YouTrack before 2020.3.6638, improper access co…7.5
• CVE-2020-2521Rejected reason: This candidate was issued in error.
• CVE-2020-25210In JetBrains YouTrack before 2020.3.7955, an attacker could …5.3