CVE-2026-75166
UnknownSummary
Insecure permission vulnerability in MBS-Solutions X-Serie Gateway firmware allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
Risk Assessment
An attacker with low privileges can gain full control over the device by executing arbitrary commands as root, leading to complete system compromise.
Recommendation
Immediately restrict permissions for service users to execute tcpdump and apply access control mechanisms such as sudo rules, or update the firmware once a patch is available.
Other vulnerabilities in MBS-Solutions X-Serie Gateway
See all- CVE-2026-75169Unknown
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths.
- CVE-2026-75168Medium
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-editfile method in /cgi-bin/wwwugw.cgi has an issue that allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. This can lead to unauthorized modification of device configuration.
- CVE-2026-75167Unknown
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.
- CVE-2026-75165Unknown
An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information.
- CVE-2026-75164Unknown
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.
- CVE-2026-75163Medium
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-deviceinfo method in /cgi-bin/wwwugw.cgi returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. This is an information disclosure vulnerability.
- CVE-2026-75162Unknown
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response.
- CVE-2026-75161Unknown
An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root.
- CVE-2026-75160Unknown
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
Original NVD description (English source)
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.