CVE-2026-75168
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-editfile method in /cgi-bin/wwwugw.cgi has an issue that allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. This can lead to unauthorized modification of device configuration.
Risk Assessment
The risk includes the possibility of configuration changes by an unprivileged user, potentially leading to network security breaches or device malfunction.
Recommendation
It is recommended to restrict access to the administrative interface and apply vendor patches if available. Also, regularly audit user permissions.
Other vulnerabilities in MBS-Solutions X-Serie Gateway
See all- CVE-2026-75160Critical
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
- CVE-2026-75169High
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths.
- CVE-2026-75167Medium
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.
- CVE-2026-75166High
Insecure permission vulnerability in MBS-Solutions X-Serie Gateway firmware allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
- CVE-2026-75165Medium
An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information.
- CVE-2026-75164Medium
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.
- CVE-2026-75163Medium
In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-deviceinfo method in /cgi-bin/wwwugw.cgi returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. This is an information disclosure vulnerability.
- CVE-2026-75162Medium
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response.
- CVE-2026-75161High
An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root.
Original NVD description (English source)
An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS