CRITICAL🇵🇱 Wersja polska

CVE-2025-41765

CVSS 9.1v3.1pub. 2026-03-09upd. 2026-03-11

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Mbs Solutions Ubr 01 Mk Ii

    HW
    Mbs-Solutions
    wszystkie wersje

  • Mbs Solutions Ubr 02

    HW
    Mbs-Solutions
    wszystkie wersje

  • Mbs Solutions Ubr Lon

    HW
    Mbs-Solutions
    wszystkie wersje

  • Mbs Solutions Universal Bacnet Router Firmware

    OS
    Mbs-Solutions
    < 6.0.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-41764CRITICAL9.1PL ✓ten sam produkt

Brak autoryzacji w MBS-Solutions Universal BACnet Router — upload firmware

CVE-2025-41756HIGH8.1ten sam produkt

A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused...

CVE-2025-41757HIGH8.8ten sam produkt

A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs wi...

CVE-2025-41758HIGH8.8ten sam produkt

A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoin...

CVE-2025-41761HIGH7.8ten sam produkt

A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privi...