Mbs-Solutions
Vulnerability activity for Mbs-Solutions: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 26
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.8HighJun 3, 2026Mbs-Solutions universal gateway firmware Memory corruptionCVE-2026-35085A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
- 8.8HighJun 3, 2026Mbs-Solutions universal gateway firmware Memory corruptionCVE-2026-35084A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
- 8.8HighJun 3, 2026Mbs-Solutions universal gateway firmware Memory corruptionCVE-2026-35083A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
- 8.8HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35082The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmwareCVE-2026-35081The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35080The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35079The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35078The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35077The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- 8.1HighJun 3, 2026Mbs-Solutions universal gateway firmware Path traversal / file handlingCVE-2026-35076The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- 9.8CriticalJun 3, 2026Mbs-Solutions universal gateway firmwareCVE-2026-35075An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
- 7.5HighMar 9, 2026Mbs-Solutions universal bacnet router firmwareCVE-2025-41772An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
- 7.2HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Crypto / certificateCVE-2025-41767A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR.
- 8.8HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Memory corruptionCVE-2025-41766A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise.
- 9.1CriticalMar 9, 2026Mbs-Solutions universal bacnet router firmware Auth bypass / access controlCVE-2025-41765Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.
- 9.1CriticalMar 9, 2026Mbs-Solutions universal bacnet router firmware Auth bypass / access controlCVE-2025-41764Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.
- 6.5MediumMar 9, 2026Mbs-Solutions universal bacnet router firmware Information disclosureCVE-2025-41763A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
- 6.2MediumMar 9, 2026Mbs-Solutions universal bacnet router firmware Crypto / certificateCVE-2025-41762An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.
- 7.8HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Code / command injectionCVE-2025-41761A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.
- 4.9MediumMar 9, 2026Mbs-Solutions universal bacnet router firmwareCVE-2025-41760An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not enforce any restrictions and allows all network traffic to pass unfiltered.
- 4.9MediumMar 9, 2026Mbs-Solutions universal bacnet router firmwareCVE-2025-41759An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.
- 8.8HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Path traversal / file handlingCVE-2025-41758A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
- 8.8HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Path traversal / file handlingCVE-2025-41757A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system.
- 8.1HighMar 9, 2026Mbs-Solutions universal bacnet router firmware Path traversal / file handlingCVE-2025-41756A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
- 6.5MediumMar 9, 2026Mbs-Solutions universal bacnet router firmware Path traversal / file handlingCVE-2025-41755A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter specifying the log file to open (e.g., /tmp/weblog{some_number}), but this parameter is not properly validated, allowing an attacker to modify it to reference any file and retrieve its contents.
- 6.5MediumMar 9, 2026Mbs-Solutions universal bacnet router firmware Path traversal / file handlingCVE-2025-41754A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.
Top products
- universal bacnet router firmware15 CVEs in the last year, 2 critical
- universal gateway firmware11 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.