Summary
The MBS Universal Gateways (UGW-A-Series, UGW-X-Series) connect devices using various digital communication protocols within the field of building automation. Several security vulnerabilities have been identified in the UGW web GUI and the underlying firmware, affecting version V6_0_0_5 and earlier.
Among other things, several CGI methods are affected by insufficient input validation and a lack of bounds checking. These flaws allow authorized attackers to perform arbitrary file deletion, include local files, or terminate system processes. Furthermore, multiple stack-based buffer overflows were discovered that can be exploited to execute arbitrary code with root privileges, leading to a full system compromise. Additionally, the firmware contains a hardcoded default password for a service account, which significantly lowers the barrier for unauthorized access.
Impact
Exploitation of these vulnerabilities may allow an authenticated attacker to read or delete arbitrary local files on the affected UGW devices, terminate system processes, or gain unauthorized access through a known service account password. Most significantly, stack-based buffer overflows in several CGI endpoints can be leveraged to execute arbitrary code with root privileges, potentially resulting in a full system compromise. In addition, these flaws can be abused to cause a denial of service or to access confidential configuration data.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Double-A Profibus | MBS Firmware <V6_0_0_7 | |
| Double-A x-link | MBS Firmware <V6_0_0_7 | |
| Double-X CAN | MBS Firmware <V6_0_0_7 | |
| Double-X DALI | MBS Firmware <V6_0_0_7 | |
| Double-X KNX | MBS Firmware <V6_0_0_7 | |
| Double-X LON | MBS Firmware <V6_0_0_7 | |
| Double-X M-Bus | MBS Firmware <V6_0_0_7 | |
| Double-X PROFINET | MBS Firmware <V6_0_0_7 | |
| Double-X x-link | MBS Firmware <V6_0_0_7 | |
| Single-A | MBS Firmware <V6_0_0_7 | |
| Single-X | MBS Firmware <V6_0_0_7 | |
| Triple-X KNX+DALI | MBS Firmware <V6_0_0_7 | |
| Triple-X KNX+LON | MBS Firmware <V6_0_0_7 | |
| Triple-X KNX+M-Bus | MBS Firmware <V6_0_0_7 | |
| Triple-X PROFINET+DALI | MBS Firmware <V6_0_0_7 | |
| Triple-X PROFINET+KNX | MBS Firmware <V6_0_0_7 | |
| Triple-X PROFINET+LON | MBS Firmware <V6_0_0_7 | |
| Triple-X PROFINET+M-Bus | MBS Firmware <V6_0_0_7 |
Vulnerabilities
Expand / Collapse allAn unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Remediation
Update the affected products to firmware version V6_0_0_7.
These are available at en.mbs-solutions.de/firmwareupdate
Acknowledgments
MBS GmbH thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
- Adrien Rey from Cyber Defense Campus Zurich for reporting (see https://www.cydcampus.admin.ch )
- Daniel Hulliger from Armasuisse for reporting (see https://www.ar.admin.ch )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 03.06.2026 15:00 | Initial revision. |