CVE-2026-35079: high-severity vulnerability in MBS Double-A Profibus
Arbitrary file delete vulnerability in method ugw-restore
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A remote attacker with user credentials can delete any file on the system through the ugw-restore method because the system doesn't properly check what files they're trying to delete.
The ugw-restore method fails to validate user-supplied file paths, allowing an authenticated remote attacker to delete arbitrary files on the system. The vulnerability requires valid user privileges but lacks proper input sanitization on the file deletion parameter, resulting in potential loss of critical system or user data.
In the same product, most dangerous first.