CVE-2025-41754: medium-severity vulnerability in MBS UBR-01 Mk II
Arbitrary Read with ubr-editfile
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An attacker with basic network access can read any file on the system by using a hidden, undocumented feature in the web server. This is dangerous because sensitive files like passwords or configuration data could be exposed.
The ubr-editfile method in wwwubr.cgi lacks proper access controls and input validation, allowing unauthenticated or low-privileged remote attackers to perform arbitrary file reads. The vulnerability stems from an undocumented API endpoint that was not properly secured or removed from the codebase.
In the same product, most dangerous first.