Vulnerability Report

CVE-2017-9134

Title: Mimosa Client Radios Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2017-9134.

CWE Category CWE-200

Published Date May 21, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.0

Exploit Probability (EPSS)

0.38%

Vulnerability Summary

CVE-2017-9134: An information-leakage issue was discovered on Mimosa Client Radios before 2.2.3 and Mimosa Backhaul Radios before 2.2.3. There is a page in the web interface that will show you the device's serial number, regardless of whether or not you have logged in. This information-leakage issue is relevant because there is another page (accessible without any authentication) that allows you to remotely factory reset the device simply by entering the serial number.

Impacted Vendors

mimosa 2

Reference Links

http://blog.iancaling.com/post/160596244178 http://blog.iancaling.com/post/160596244178

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns