CVE-2026-35080highCWE-73

CVE-2026-35080: high-severity vulnerability in MBS Double-A Profibus

Arbitrary file delete vulnerability in method ugw-restoreinfo

Published · Updated

Follow this CVE+ Monitor Double-A Profibus+ Monitor Double-A x-link

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.4%
In short

A remote attacker with user access can delete any file on the system through the ugw-restoreinfo method because the system doesn't properly validate what files are being deleted. This is dangerous because it can destroy important data or system files.

Technical detail

The ugw-restoreinfo method fails to validate user-supplied file path inputs, allowing authenticated remote attackers to delete arbitrary files on the system (CWE-73: External Control of File Name or Path). The vulnerability requires valid user credentials but lacks path traversal protections or whitelist restrictions, resulting in confidentiality and integrity impact through unauthorized file deletion.

Summary generated and translated by AI from the official description.
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
MBS · Double-A ProfibusMBS · Double-A x-linkMBS · Double-X CANMBS · Double-X DALIMBS · Double-X KNXMBS · Double-X LONMBS · Double-X M-BusMBS · Double-X PROFINETMBS · Double-X x-linkMBS · Single-AMBS · Single-XMBS · Triple-X KNX+DALIMBS · Triple-X KNX+LONMBS · Triple-X KNX+M-BusMBS · Triple-X PROFINET+DALIMBS · Triple-X PROFINET+KNXMBS · Triple-X PROFINET+LONMBS · Triple-X PROFINET+M-Bus
Related CVEs — MBS Double-A Profibus

In the same product, most dangerous first.

CVE-2026-35082HIGHLocal file inclusion vulnerability and deletion in ugw-logread methodEPSS 0.5%CVE-2026-35085HIGHStack buffer overflow in method gdv-serverconfigEPSS 0.5%CVE-2026-35075CRITICALHardcoded default Password for Service AccountEPSS 0.5%CVE-2026-35084HIGHStack buffer overflow in method dali-devconfigEPSS 0.5%CVE-2026-35083HIGHStack buffer overflow in method bac-deviceobjectEPSS 0.5%CVE-2026-35081HIGHArbitrary process termination vulnerability in method ugw-logstopEPSS 0.4%