CVE-2025-41766: high-severity vulnerability in MBS UBR-01 Mk II
Stack buffer overflow on parsing web request
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A specially crafted HTTP request can cause the application to crash or allow an attacker to take over the device completely. This happens because the program doesn't properly check the size of data it receives before storing it in memory.
Stack-based buffer overflow (CWE-787) in the ubr-network method triggered by malicious HTTP POST requests from remote, low-privileged attackers. The vulnerability results from insufficient input validation on request parsing, enabling arbitrary code execution and full device compromise.
In the same product, most dangerous first.