← Back

CVE-2025-41772

nvd nist
Published: Mar 9, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: info@cert.vde.com (Secondary)

Description

An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.

Affected (1)

Mbs Solutions
1 product
Universal Bacnet Router Firmware
Configuration A
1 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Universal Bacnet Router Firmware
Before 6.0.1.0
Running on/withPlatform Versions
Mbs Solutions
Ubr 01 Mk Ii
All versions
Mbs Solutions
Ubr 02
All versions
Mbs Solutions
Ubr Lon
All versions

Related CWEs

CWE-598
Use of GET Request Method With Sensitive Query Strings
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

References (1)

Source: info@cert.vde.com
Vendor Advisory

Timeline

No history available yet.