CVE-2025-41772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-41772
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.mbs-solutions.de/mbs-2025-0001 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*
History

11 Mar 2026, 18:23

Type Values Removed Values Added
References () https://www.mbs-solutions.de/mbs-2025-0001 - () https://www.mbs-solutions.de/mbs-2025-0001 - Vendor Advisory
First Time Mbs-solutions
Mbs-solutions ubr-lon
Mbs-solutions ubr-01 Mk Ii
Mbs-solutions ubr-02
Mbs-solutions universal Bacnet Router Firmware
Summary
  • (es) Un atacante remoto no autenticado puede obtener tokens de sesión válidos porque están expuestos en texto plano dentro de los parámetros de la URL del endpoint wwwupdate.cgi en UBR.
CPE cpe:2.3:h:mbs-solutions:ubr-02:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-01_mk_ii:-:*:*:*:*:*:*:*
cpe:2.3:h:mbs-solutions:ubr-lon:-:*:*:*:*:*:*:*
cpe:2.3:o:mbs-solutions:universal_bacnet_router_firmware:*:*:*:*:*:*:*:*

09 Mar 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-09 09:16

Updated : 2026-03-11 18:23

NVD link : CVE-2025-41772

Mitre link : CVE-2025-41772

CVE.ORG link : CVE-2025-41772

JSON object : View

Products Affected

mbs-solutions

  • ubr-lon
  • ubr-02
  • universal_bacnet_router_firmware
  • ubr-01_mk_ii
CWE
CWE-598

Use of GET Request Method With Sensitive Query Strings