Summary
The MBS Universal Gateways (UGW-A-Series, UGW-X-Series) connect devices using various digital communication protocols within the field of building automation. Several security vulnerabilities have been identified in the UGW web GUI and the underlying firmware, affecting version V6_0_0_5 and earlier.
Among other things, several CGI methods are affected by insufficient input validation and a lack of bounds checking. These flaws allow authorized attackers to perform arbitrary file deletion, include local files, or terminate system processes. Furthermore, multiple stack-based buffer overflows were discovered that can be exploited to execute arbitrary code with root privileges, leading to a full system compromise. Additionally, the firmware contains a hardcoded default password for a service account, which significantly lowers the barrier for unauthorized access.
Details
Impact
Exploitation of these vulnerabilities may allow an authenticated attacker to read or delete arbitrary local files on the affected UGW devices, terminate system processes, or gain unauthorized access through a known service account password. Most significantly, stack-based buffer overflows in several CGI endpoints can be leveraged to execute arbitrary code with root privileges, potentially resulting in a full system compromise. In addition, these flaws can be abused to cause a denial of service or to access confidential configuration data.
Remediation
Update the affected products to firmware version V6_00_07.
These are available at https://en.mbs-solutions.de/firmwareupdate
Vulnerabilities 11
-
Critical 9.8
Hardcoded default Password for Service Account
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
-
High 8.8
Local file inclusion vulnerability and deletion in ugw-logread method
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
-
High 8.8
Stack buffer overflow in method bac-deviceobject
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
-
High 8.8
Stack buffer overflow in method dali-devconfig
A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.
-
High 8.8
Stack buffer overflow in method gdv-serverconfig
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
-
High 8.1
Arbitrary file delete vulnerability in method bac-scanresult
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
-
High 8.1
Arbitrary file delete vulnerability in method ugw-delete-file
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
-
High 8.1
Arbitrary file delete vulnerability in method ugw-logstop
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
-
High 8.1
Arbitrary file delete vulnerability in method ugw-restore
The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
-
High 8.1
Arbitrary file delete vulnerability in method ugw-restoreinfo
The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
-
High 8.1
Arbitrary process termination vulnerability in method ugw-logstop
The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.
Revision history
-
#2.0.0
correct version
-
#1.0.1
Added acknowledgment
-
#1.0.0
Initial revision.
References
-
CERT@VDE Security Advisories for MBS GmbH
https://www.certvde.com/en/advisories/vendor/mbs
-
VDE-2026-039: MBS: Several security vulnerabilities in the UGW web GUI - HTML
https://www.certvde.com/en/advisories/VDE-2026-039/