Summary
The MBS Universal Gateways (UGW-A-Series, UGW-X-Series) connect devices using various digital communication protocols within the field of building automation. Several security vulnerabilities have been identified in the UGW web GUI and the underlying firmware, affecting version V6_0_0_5 and earlier.
Among other things, several CGI methods are affected by insufficient input validation and a lack of bounds checking. These flaws allow authorized attackers to perform arbitrary file deletion, include local files, or terminate system processes. Furthermore, multiple stack-based buffer overflows were discovered that can be exploited to execute arbitrary code with root privileges, leading to a full system compromise. Additionally, the firmware contains a hardcoded default password for a service account, which significantly lowers the barrier for unauthorized access.
Impact
Exploitation of these vulnerabilities may allow an authenticated attacker to read or delete arbitrary local files on the affected UGW devices, terminate system processes, or gain unauthorized access through a known service account password. Most significantly, stack-based buffer overflows in several CGI endpoints can be leveraged to execute arbitrary code with root privileges, potentially resulting in a full system compromise. In addition, these flaws can be abused to cause a denial of service or to access confidential configuration data.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Double-A Profibus | MBS Firmware <V6_00_07 | |
| Double-A x-link | MBS Firmware <V6_00_07 | |
| Double-X CAN | MBS Firmware <V6_00_07 | |
| Double-X DALI | MBS Firmware <V6_00_07 | |
| Double-X KNX | MBS Firmware <V6_00_07 | |
| Double-X LON | MBS Firmware <V6_00_07 | |
| Double-X M-Bus | MBS Firmware <V6_00_07 | |
| Double-X PROFINET | MBS Firmware <V6_00_07 | |
| Double-X x-link | MBS Firmware <V6_00_07 | |
| Single-A | MBS Firmware <V6_00_07 | |
| Single-X | MBS Firmware <V6_00_07 | |
| Triple-X KNX+DALI | MBS Firmware <V6_00_07 | |
| Triple-X KNX+LON | MBS Firmware <V6_00_07 | |
| Triple-X KNX+M-Bus | MBS Firmware <V6_00_07 | |
| Triple-X PROFINET+DALI | MBS Firmware <V6_00_07 | |
| Triple-X PROFINET+KNX | MBS Firmware <V6_00_07 | |
| Triple-X PROFINET+LON | MBS Firmware <V6_00_07 | |
| Triple-X PROFINET+M-Bus | MBS Firmware <V6_00_07 |
Vulnerabilities
Expand / Collapse allEnabling SSH through the device web interface immediately exposes the service account with this known password.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
An attacker can read and subsequently write arbitrary local files, resulting in loss of confidentiality, integrity, and availability.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
An attacker can execute arbitrary code with root privileges, leading to full system compromise.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
An attacker can execute arbitrary code with root privileges, leading to full system compromise.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
An attacker can execute arbitrary code with root privileges, leading to full system compromise.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
An attacker can delete arbitrary local files, resulting in a loss of system integrity and potential denial of service.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
An attacker can delete arbitrary local files, resulting in loss of system integrity and potential denial of service.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
An attacker can delete arbitrary local files, resulting in loss of system integrity and potential denial of service.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
An attacker can delete arbitrary local files with root privileges, resulting in complete loss of system integrity and potential denial of service.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
An attacker can delete arbitrary local files with root privileges, resulting in complete loss of system integrity and potential denial of service.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
An attacker can terminate arbitrary processes with root privileges, resulting in denial of service and disruption of system functionality.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
Remediation
Update the affected products to firmware version V6_00_07.
These are available at en.mbs-solutions.de/firmwareupdate
Acknowledgments
MBS GmbH thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
- Daniel Hulliger from Armasuisse Cyber-Defence campus. for reporting (see https://www.ar.admin.ch )
- Damian Pfammatter from Armasuisse Cyber-Defence campus. for reporting (see https://www.ar.admin.ch )
- Adrien Rey from Armasuisse Cyber Defense Campus Zurich for reporting (see https://www.cydcampus.admin.ch )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 06/03/2026 15:00 | Initial revision. |
| 1.0.1 | 06/09/2026 15:00 | Added acknowledgment |
| 2.0.0 | 07/03/2026 15:00 | correct version |