← Back

CVE-2025-41761

nvd nist
Published: Mar 9, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: info@cert.vde.com (Secondary)

Description

A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.

Affected (1)

Mbs Solutions
1 product
Universal Bacnet Router Firmware
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Universal Bacnet Router Firmware
Before 6.0.1.0
Running on/withPlatform Versions
Mbs Solutions
Ubr 01 Mk Ii
All versions
Mbs Solutions
Ubr 02
All versions
Mbs Solutions
Ubr Lon
All versions

Related CWEs

CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (1)

Source: info@cert.vde.com
Vendor Advisory

Timeline

No history available yet.