MBS UGW Firmware Multiple CVEs: RCE/LFI/Stack Overflow

Vulnerability Overview Multiple security vulnerabilities exist in the web GUI and underlying firmware of MBS Universal Gateways (UGW-A-Series, UGW-X-Series). These vulnerabilities include: Arbitrary File Deletion: Attackers can delete arbitrary local files. Local File Inclusion: Attackers can include local files. Termination of System Processes: Attackers can terminate system processes. Stack Buffer Overflow: Multiple stack overflow vulnerabilities allow authenticated attackers to execute arbitrary code with root privileges, resulting in full system compromise. Hardcoded Default Passwords: A hardcoded default password for a service account is present in the firmware, lowering the barrier for unauthorized access. Affected Products The following MBS Universal Gateways products and their firmware versions are affected: Double-A Profibus Double-A x-link Double-X CAN Double-X DALI Double-X KNX Double-X LON Double-X M-Bus Double-X PROFINET Double-X x-link Single-A Single-X Triple-X KNX+DALI Triple-X KNX+LON Triple-X KNX+M-Bus Triple-X PROFINET+DALI Triple-X PROFINET+KNX Triple-X PROFINET+LON Triple-X PROFINET+M-Bus The firmware version for all the above products is MBS Firmware < V6_0_0_7. Remediation It is recommended to update affected products to firmware version V6_0_0_7. Firmware updates are available at the following link: en.mbs-solutions.de/firmwareupdate. Vulnerability Details The specific vulnerabilities and their CVSS scores are listed below: CVE-2026-35075 (CVSS 8.8) CVE-2026-35085 (CVSS 8.8) CVE-2026-35084 (CVSS 8.8) CVE-2026-35083 (CVSS 8.8) CVE-2026-35082 (CVSS 8.8) CVE-2026-35081 (CVSS 8.1) CVE-2026-35080 (CVSS 8.1) CVE-2026-35079 (CVSS 8.1) CVE-2026-35078 (CVSS 8.1) CVE-2026-35077 (CVSS 8.1) CVE-2026-35076 (CVSS 8.1) Acknowledgments MBS GmbH thanks the following parties for their efforts: CERT@VDE: Coordination (https://certvde.com) Daniel Hülliger: Report from Armasuisse Cyber-Defence campus (https://www.ar.admin.ch) Damian Pfammatter: Report from Armasuisse Cyber-Defence campus (https://www.ar.admin.ch) Adrien Rey: Report from Armasuisse Cyber Defense Campus Zurich (https://www.cydcampus.admin.ch) Revision History Version 1.0.0: Initial revision (March 6, 2026, 15:00) Version 1.0.1: Added acknowledgments (September 6, 2026, 15:00) Summary Multiple severe security vulnerabilities in the web GUI and firmware of MBS Universal Gateways can lead to full system compromise. It is recommended to update the firmware to version V6_0_0_7 as soon as possible to remediate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

MBS UGW Firmware Multiple CVEs: RCE/LFI/Stack Overflow