CVE-2025-41758: high-severity vulnerability in MBS UBR-01 Mk II
Arbitrary Write with wwwupload.cgi
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
In short
A vulnerability in wwwupload.cgi allows an attacker to write files anywhere on the system by using path traversal tricks, potentially taking complete control of the device.
Technical detail
The wwwupload.cgi endpoint fails to properly validate file paths, enabling a low-privileged remote attacker to perform arbitrary file write operations via path traversal (CWE-22). This can result in overwriting critical system files and achieving remote code execution or full system compromise.
Summary generated and translated by AI from the official description.
A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CVEs — MBS UBR-01 Mk II
In the same product, most dangerous first.
CVE-2025-41757HIGHArbitrary Write with ubr-restoreEPSS 0.6%CVE-2025-41755MEDIUMArbitrary Read with ubr-logreadEPSS 0.6%CVE-2025-41766HIGHStack buffer overflow on parsing web requestEPSS 0.5%CVE-2025-41764CRITICALUnchecked role in wwwupdate.cgiEPSS 0.4%CVE-2025-41754MEDIUMArbitrary Read with ubr-editfileEPSS 0.4%CVE-2025-41756HIGHArbitrary Write with ubr-editfileEPSS 0.4%