CVE-2025-41759: medium-severity vulnerability in MBS UBR-01 Mk II
Use of wildcard (“*” or “all”) in Block list
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An administrator trying to block all networks by using a wildcard ("*" or "all") thinks the block worked, but the system silently ignores it and blocks nothing instead. This creates a false sense of security.
The application accepts wildcard values ("*" or "all") in network blocklists without validation, silently defaulting to network 0 instead of blocking all networks. An attacker with network access can exploit this misconfiguration if an administrator believes they have implemented a comprehensive network block policy.
In the same product, most dangerous first.