CVE-2026-75164
UnknownSummary
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.
Risk Assessment
An attacker can read sensitive files such as configurations, passwords, or keys, potentially leading to full compromise of the device and network.
Recommendation
Restrict access to ugwdownload.cgi only to authorized administrators and validate and secure input parameters to prevent arbitrary file reads.
Other vulnerabilities in MBS-Solutions X-Serie Gateway
See all- CVE-2026-75169Unknown
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths.
- CVE-2026-75168Medium
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-editfile method in /cgi-bin/wwwugw.cgi has an issue that allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. This can lead to unauthorized modification of device configuration.
- CVE-2026-75167Unknown
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.
- CVE-2026-75166Unknown
Insecure permission vulnerability in MBS-Solutions X-Serie Gateway firmware allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
- CVE-2026-75165Unknown
An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information.
- CVE-2026-75163Medium
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-deviceinfo method in /cgi-bin/wwwugw.cgi returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. This is an information disclosure vulnerability.
- CVE-2026-75162Unknown
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response.
- CVE-2026-75161Unknown
An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root.
- CVE-2026-75160Unknown
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
Original NVD description (English source)
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.