CVE-2026-35080
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Risk Assessment
The risk is that an attacker can delete important system or configuration files, potentially leading to data loss or system instability.
Recommendation
It is recommended to immediately apply vendor patches that strengthen input validation in the ugw-restoreinfo method, and restrict access to this method to trusted users only.
Other vulnerabilities in UGW
See all- CVE-2026-35081High
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
- CVE-2026-35079High
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- CVE-2026-35078High
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- CVE-2026-35077High
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
- CVE-2026-35076High
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
Original NVD description (English source)
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.