CVE-2025-41764criticalCWE-862

CVE-2025-41764: critical vulnerability in MBS UBR-01 Mk II

Unchecked role in wwwupdate.cgi

Published

Follow this CVE+ Monitor UBR-01 Mk II+ Monitor UBR-02

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.4%
In short

A vulnerability in the wwwupdate.cgi file allows anyone on the internet to upload and install malicious software updates without proper permission checks. This is critical because attackers can completely take over the affected system.

Technical detail

CWE-862 (Missing Authorization) allows unauthenticated remote attackers to access the wwwupdate.cgi endpoint and upload arbitrary update packages due to insufficient authorization controls. The vulnerability enables unauthorized code execution with system privileges, resulting in complete system compromise.

Summary generated and translated by AI from the official description.
Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
MBS · UBR-01 Mk IIMBS · UBR-02MBS · UBR-LON
Related CVEs — MBS UBR-01 Mk II

In the same product, most dangerous first.

CVE-2025-41758HIGHArbitrary Write with wwwupload.cgiEPSS 0.6%CVE-2025-41757HIGHArbitrary Write with ubr-restoreEPSS 0.6%CVE-2025-41755MEDIUMArbitrary Read with ubr-logreadEPSS 0.6%CVE-2025-41766HIGHStack buffer overflow on parsing web requestEPSS 0.5%CVE-2025-41754MEDIUMArbitrary Read with ubr-editfileEPSS 0.4%CVE-2025-41756HIGHArbitrary Write with ubr-editfileEPSS 0.4%