CVE-2025-41762

Published: Mar 9, 2026Modified: Jun 17, 2026

6.2

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.5 / Impact: 3.6

Source: info@cert.vde.com (Secondary)

Description

An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.

Affected (1)

Products: Mbs Solutions: Universal Bacnet Router Firmware

Mbs Solutions

1 product

Universal Bacnet Router Firmware

Configuration A

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Mbs Solutions Universal Bacnet Router Firmware	Before 6.0.1.0

Running on/with	Platform Versions
Mbs Solutions Ubr 01 Mk Ii	All versions
Mbs Solutions Ubr 02	All versions
Mbs Solutions Ubr Lon	All versions

Related CWEs

CWE-328

Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References (1)

https://www.mbs-solutions.de/mbs-2025-0001

Source: info@cert.vde.com

Vendor Advisory

Timeline

No history available yet.