MBS vulnerabilities

Latest high and critical flaws

• CVE-2026-35085 A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.High 8.7 · Jun 3, 2026
• CVE-2026-35084 A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.High 8.7 · Jun 3, 2026
• CVE-2026-35083 A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.High 8.7 · Jun 3, 2026
• CVE-2026-35082 The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.High 8.7 · Jun 3, 2026
• CVE-2026-35081 The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.High 7.2 · Jun 3, 2026
• CVE-2026-35080 The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled inputHigh 7.2 · Jun 3, 2026
• CVE-2026-35079 The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.High 7.2 · Jun 3, 2026
• CVE-2026-35078 The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.High 7.2 · Jun 3, 2026
• CVE-2026-35077 The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled inpuHigh 7.2 · Jun 3, 2026
• CVE-2026-35076 The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.High 7.2 · Jun 3, 2026
• CVE-2026-35075 An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.Critical 9.3 · Jun 3, 2026
• CVE-2025-41772 An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpointHigh 7.5 · Mar 9, 2026
• CVE-2025-41767 A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web intHigh 7.2 · Mar 9, 2026
• CVE-2025-41766 A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full deviceHigh 8.8 · Mar 9, 2026
• CVE-2025-41765 Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data.Critical 9.1 · Mar 9, 2026
• CVE-2025-41764 Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.Critical 9.1 · Mar 9, 2026
• CVE-2025-41761 A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access.High 7.8 · Mar 9, 2026
• CVE-2025-41758 A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint.High 8.8 · Mar 9, 2026
• CVE-2025-41757 A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the cHigh 8.8 · Mar 9, 2026
• CVE-2025-41756 A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the systHigh 8.1 · Mar 9, 2026