← Back

CVE-2025-41765

nvd nist
Published: Mar 9, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitability: 3.9 / Impact: 5.2
Source: info@cert.vde.com (Secondary)

Description

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

Affected (1)

Mbs Solutions
1 product
Universal Bacnet Router Firmware
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Universal Bacnet Router Firmware
Before 6.0.1.0
Running on/withPlatform Versions
Mbs Solutions
Ubr 01 Mk Ii
All versions
Mbs Solutions
Ubr 02
All versions
Mbs Solutions
Ubr Lon
All versions

Related CWEs

CWE-862
Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

Source: info@cert.vde.com
Vendor Advisory

Timeline

No history available yet.