by Kastro
Paper/Archive/CVE-2025-41765

CVE-2025-41765

MBS UBR-01 Mk II — Unchecked role in wwwupload.cgi

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 19.2.192 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

Affected

ProductAffectedFixed inSource
UBR-01 Mk II0.0.0 – < 6.0.1.06.0.1.0CNA
UBR-020.0.0 – < 6.0.1.06.0.1.0CNA
UBR-LON0.0.0 – < 6.0.1.06.0.1.0CNA

Scores by source

CERTVDE (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refmbs-solutions.de/mbs-2025-0001