CVE-2025-41756

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-41756
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.mbs-solutions.de/mbs-2025-0001 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*
History

11 Mar 2026, 18:26

Type Values Removed Values Added
References () https://www.mbs-solutions.de/mbs-2025-0001 - () https://www.mbs-solutions.de/mbs-2025-0001 - Vendor Advisory
Summary
  • (es) Un atacante remoto de bajo privilegio puede explotar el método ubr-editfile en wwwubr.cgi, un endpoint de API no documentado y sin usar para escribir archivos arbitrarios en el sistema.
First Time Mbs-solutions
Mbs-solutions ubr-lon
Mbs-solutions ubr-01 Mk Ii
Mbs-solutions ubr-02
Mbs-solutions universal Bacnet Router Firmware
CPE cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*
cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*

09 Mar 2026, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-09 09:15

Updated : 2026-03-11 18:26

NVD link : CVE-2025-41756

Mitre link : CVE-2025-41756

CVE.ORG link : CVE-2025-41756

JSON object : View

Products Affected

mbs-solutions

  • ubr-lon
  • ubr-02
  • universal_bacnet_router_firmware
  • ubr-01_mk_ii
CWE
CWE-1242

Inclusion of Undocumented Features or Chicken Bits